9ddd4d24ce8938b015e65ec28acc0234688d52ea5601185986f68c34db2518dd

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 04:09

Target

d529976bb0713e1e3998a501384612a5.exe
Size

122KB
MD5

d529976bb0713e1e3998a501384612a5
SHA1

4a847ca5fd5adf51d458817e355e77164a0ee3b9
SHA256

9ddd4d24ce8938b015e65ec28acc0234688d52ea5601185986f68c34db2518dd
SHA512

9e37e29c0327e6d33bc12ed6ed6dd222fc18acf9b9d07619118bd1b154cf31ac1717a4808087933fa611ae9d7656a66399d89c13546c2daf9ca5d8aedc1f2d8c
SSDEEP

3072:BpeBdjM9fnqtB5oMLL0ZFcPPPjpRKYXbW2WP3zZRGSmgZlXX5:TeXM9fM0ZFcPXlEs/W72SLp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2344	1332	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 2344	1332	d529976bb0713e1e3998a501384612a5.exe	28
PID 1332 wrote to memory of 2344	1332	d529976bb0713e1e3998a501384612a5.exe	28
PID 1332 wrote to memory of 2344	1332	d529976bb0713e1e3998a501384612a5.exe	28
PID 1332 wrote to memory of 2344	1332	d529976bb0713e1e3998a501384612a5.exe	28

C:\Users\Admin\AppData\Local\Temp\d529976bb0713e1e3998a501384612a5.exe
"C:\Users\Admin\AppData\Local\Temp\d529976bb0713e1e3998a501384612a5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 36
  2⤵
  - Program crash
  PID:2344

memory/1332-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download