ee5003efd1b2a8ede3c16b97dbe0be1929cbec47f9c5ed3a67e8e870801e979e

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 08:26

Target

cd9404ae88b502c39d843b03185a5972.exe
Size

21KB
MD5

cd9404ae88b502c39d843b03185a5972
SHA1

29aed17cab0edff3147be27cc49f18fc26f1e8b3
SHA256

ee5003efd1b2a8ede3c16b97dbe0be1929cbec47f9c5ed3a67e8e870801e979e
SHA512

fbe29d11d6cb7a1fbdc5d1f4f84ff6f8863a0a92398efa800e688e0b31f6bdb3d83e9d9c822d04b77aa115e9ebfafe4fbb9f709b4b5346a1be2a02cf65544ddc
SSDEEP

384:yjEzPdssGWCbp26xrN4v2S2tpbHDzzPIzobeoIWFEHLNdshmI6AVoekWxb:yjE7IJbPpWlUpjTAP6FErNGcAq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2928	2876	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2928	2876	cd9404ae88b502c39d843b03185a5972.exe	28
PID 2876 wrote to memory of 2928	2876	cd9404ae88b502c39d843b03185a5972.exe	28
PID 2876 wrote to memory of 2928	2876	cd9404ae88b502c39d843b03185a5972.exe	28
PID 2876 wrote to memory of 2928	2876	cd9404ae88b502c39d843b03185a5972.exe	28

C:\Users\Admin\AppData\Local\Temp\cd9404ae88b502c39d843b03185a5972.exe
"C:\Users\Admin\AppData\Local\Temp\cd9404ae88b502c39d843b03185a5972.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 88
  2⤵
  - Program crash
  PID:2928

memory/2876-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2876-1-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download