3f809ee7092a0b1ad22c7b4260f57f00813e7f6b022b08b6b296aba7b325e190

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 03:10

Target

ca546a1a643e21b032acdda01d45ec0c.exe
Size

422KB
MD5

ca546a1a643e21b032acdda01d45ec0c
SHA1

b8718a38b290ab6ab141338541a17be05039d672
SHA256

3f809ee7092a0b1ad22c7b4260f57f00813e7f6b022b08b6b296aba7b325e190
SHA512

c178850ff851d592a864eebac9ef620b5fda60a7fb3972bf0070025bf864188a911e509bd65bc63a77cfd369c08d40605113c38f6cfefd311abff94368c4592b
SSDEEP

6144:ykB1INZdWaFzaE7mDGg7Y4+MFyBPys80G5sEOi9Ri9na5UVx3:ykBgdW/E7mDGg8xMkBp80GiZa5UVh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2980	2928	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2980	2928	ca546a1a643e21b032acdda01d45ec0c.exe	28
PID 2928 wrote to memory of 2980	2928	ca546a1a643e21b032acdda01d45ec0c.exe	28
PID 2928 wrote to memory of 2980	2928	ca546a1a643e21b032acdda01d45ec0c.exe	28
PID 2928 wrote to memory of 2980	2928	ca546a1a643e21b032acdda01d45ec0c.exe	28

C:\Users\Admin\AppData\Local\Temp\ca546a1a643e21b032acdda01d45ec0c.exe
"C:\Users\Admin\AppData\Local\Temp\ca546a1a643e21b032acdda01d45ec0c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 116
  2⤵
  - Program crash
  PID:2980

memory/2928-0-0x00000000011B0000-0x000000000121E000-memory.dmp

Filesize
440KB

Download