43ea02e4891ff874abb444409e0b1ce7fcd7a594b8267dded322d4447c35076b

Analysis

max time kernel
118s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 00:27

Target

c47fe71c2b36bbe0ea78271b04a4448e.exe
Size

117KB
MD5

c47fe71c2b36bbe0ea78271b04a4448e
SHA1

a6831dfff386eb5d105979053ffe12b2c498be72
SHA256

43ea02e4891ff874abb444409e0b1ce7fcd7a594b8267dded322d4447c35076b
SHA512

bb79608da41e2b8d2b7a4fc18337c09d673b63ecbbce4d75670ac82704f0da3286cd477f9bbcd3839cdbc99b6e5c139b5f02257fedd14f595b29a62b5da3ce69
SSDEEP

3072:/USB61VyNOymrrAAZJ1CqlucuJbMSTAJB7tur1APly:sScbIrmvAAVCqlPbB7MQly

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2604	3032	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2604	3032	c47fe71c2b36bbe0ea78271b04a4448e.exe	29
PID 3032 wrote to memory of 2604	3032	c47fe71c2b36bbe0ea78271b04a4448e.exe	29
PID 3032 wrote to memory of 2604	3032	c47fe71c2b36bbe0ea78271b04a4448e.exe	29
PID 3032 wrote to memory of 2604	3032	c47fe71c2b36bbe0ea78271b04a4448e.exe	29

C:\Users\Admin\AppData\Local\Temp\c47fe71c2b36bbe0ea78271b04a4448e.exe
"C:\Users\Admin\AppData\Local\Temp\c47fe71c2b36bbe0ea78271b04a4448e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 36
  2⤵
  - Program crash
  PID:2604

memory/3032-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3032-1-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download