3e8664998ab309b5348dadd6e92e64fa1229ff63a084f2470d605d892f1dd445

Analysis

max time kernel
143s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 02:51

Target
c4c921fa95f73a8404d58d4dfac91271.exe
Size 1.1MB
Sample240313-dcdl9sda53
SHA256 3e8664998ab309b5348dadd6e92e64fa1229ff63a084f2470d605d892f1dd445
MD5 c4c921fa95f73a8404d58d4dfac91271
SHA1 0b2e4a9a91e7841029c3eacbd82f5b626da2c740
SHA512 1334478916cf738fd469cb1e2ee9b9fde6b0ee706b3f99c31f559126b99fa75bf4df7adfca2a37e911cb60f08b13a88dfa190cb3eee5633849e9d8d2e3f78c4b
SSDEEP 24576:ViLvo6MdmIRegLl6gzX1CM74BdGBU8/6vxLqVKWEt9a41PNqIA:Qo6MdbReyl6YIA4G6fv0wLt9ayNHA
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1636	2176	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1636	2176	c4c921fa95f73a8404d58d4dfac91271.exe	28
PID 2176 wrote to memory of 1636	2176	c4c921fa95f73a8404d58d4dfac91271.exe	28
PID 2176 wrote to memory of 1636	2176	c4c921fa95f73a8404d58d4dfac91271.exe	28
PID 2176 wrote to memory of 1636	2176	c4c921fa95f73a8404d58d4dfac91271.exe	28

C:\Users\Admin\AppData\Local\Temp\c4c921fa95f73a8404d58d4dfac91271.exe
"C:\Users\Admin\AppData\Local\Temp\c4c921fa95f73a8404d58d4dfac91271.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 36
  2⤵
  - Program crash
  PID:1636

memory/2176-0-0x0000000000400000-0x00000000004DE000-memory.dmp

Download

memory/2176-1-0x0000000000400000-0x00000000004DE000-memory.dmp

Download