760216bceaa7ab3dec88da660fd919a514661b2db5c971981b0300d607abd416

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 01:20

Target

c49a9d1dd21d1f2795500fae5c4e0f1d.exe
Size

27KB
MD5

c49a9d1dd21d1f2795500fae5c4e0f1d
SHA1

f023890edef5799a88dae396bbf0a9a93c744518
SHA256

760216bceaa7ab3dec88da660fd919a514661b2db5c971981b0300d607abd416
SHA512

d2507d277e7fb13cfbddb8124fa40a762bc0d852d5b672729d9e48c4b3a7cc457b38954becc952d0e68c24f12dcdbdb37f9024324b8c425228b28586c1292970
SSDEEP

384:ly4V8exAFwmpZwMSRJE+svv//BCLNrpUIaw4OvYqDG1qv6q:XV8eJMwMSvynBYp/YqD/3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2872	2464	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2872	2464	c49a9d1dd21d1f2795500fae5c4e0f1d.exe	28
PID 2464 wrote to memory of 2872	2464	c49a9d1dd21d1f2795500fae5c4e0f1d.exe	28
PID 2464 wrote to memory of 2872	2464	c49a9d1dd21d1f2795500fae5c4e0f1d.exe	28
PID 2464 wrote to memory of 2872	2464	c49a9d1dd21d1f2795500fae5c4e0f1d.exe	28

C:\Users\Admin\AppData\Local\Temp\c49a9d1dd21d1f2795500fae5c4e0f1d.exe
"C:\Users\Admin\AppData\Local\Temp\c49a9d1dd21d1f2795500fae5c4e0f1d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 116
  2⤵
  - Program crash
  PID:2872

memory/2464-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2464-1-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2464-2-0x00000000001B0000-0x00000000001E0000-memory.dmp

Filesize
192KB

Download
memory/2464-3-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download