575b501bfddf2e0ddae1afc278a55318ff7e24039d2c9398a200ffd731bae4af

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 12:04

Target

ce04875198cef6bd8f9e7453d6b06462.exe
Size

194KB
MD5

ce04875198cef6bd8f9e7453d6b06462
SHA1

6d9fa99bedad7405273b52aae133ae60f04420ba
SHA256

575b501bfddf2e0ddae1afc278a55318ff7e24039d2c9398a200ffd731bae4af
SHA512

1809ec61fd15662d0ebdb123d6efc50cc262f7f7132b545ee735eb063fb1d066d4c6b58163793d0b89dd61b33d11f64344d6072eb51acd1cdb359ab36a5dc125
SSDEEP

3072:gRz9A2PCaq7EyM0ODaId2nDCMAnBSufSG+ZUdQlNIEkPllhXXLJbSj38I3K/Hm:gR5A1T1J17neH8aWKdkNIEA3hXbhTHm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1612	2128	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1612	2128	ce04875198cef6bd8f9e7453d6b06462.exe	28
PID 2128 wrote to memory of 1612	2128	ce04875198cef6bd8f9e7453d6b06462.exe	28
PID 2128 wrote to memory of 1612	2128	ce04875198cef6bd8f9e7453d6b06462.exe	28
PID 2128 wrote to memory of 1612	2128	ce04875198cef6bd8f9e7453d6b06462.exe	28

C:\Users\Admin\AppData\Local\Temp\ce04875198cef6bd8f9e7453d6b06462.exe
"C:\Users\Admin\AppData\Local\Temp\ce04875198cef6bd8f9e7453d6b06462.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 116
  2⤵
  - Program crash
  PID:1612

memory/2128-0-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/2128-2-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/2128-1-0x00000000002B0000-0x00000000002E0000-memory.dmp

Filesize
192KB

Download
memory/2128-3-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download