45a0711520ee1e3142d28f581e78fe69f8e25e3bc27541a17e3787dbda6c8abb

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 20:16

Target

d705b13edc3e375536b23f72b3d0d030.exe
Size

367KB
MD5

d705b13edc3e375536b23f72b3d0d030
SHA1

5323317ea840572dc7f69a86f3f722366edfa761
SHA256

45a0711520ee1e3142d28f581e78fe69f8e25e3bc27541a17e3787dbda6c8abb
SHA512

ed24c6b39f72c68450382a81983a1a1b6b87b4a49b38d41f4d9e7060316146694cbb7079b6c4aa03450435d8e5a122d720866ecc5f56895561c368a2aedca47d
SSDEEP

6144:rpEcAd/Mm5ZkyUneRTnJOmQ4W4/6zA5K0TzJRCp4xRvKUllD/W13+e:rTAOm5eyUnJmCzAXTzJR3RvK6lCwe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
776	2220	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 776	2220	d705b13edc3e375536b23f72b3d0d030.exe	28
PID 2220 wrote to memory of 776	2220	d705b13edc3e375536b23f72b3d0d030.exe	28
PID 2220 wrote to memory of 776	2220	d705b13edc3e375536b23f72b3d0d030.exe	28
PID 2220 wrote to memory of 776	2220	d705b13edc3e375536b23f72b3d0d030.exe	28

C:\Users\Admin\AppData\Local\Temp\d705b13edc3e375536b23f72b3d0d030.exe
"C:\Users\Admin\AppData\Local\Temp\d705b13edc3e375536b23f72b3d0d030.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 116
  2⤵
  - Program crash
  PID:776

memory/2220-0-0x0000000000920000-0x0000000000980000-memory.dmp

Filesize
384KB

Download