e4e106ee997ade1dcd69db69d87d8c9b46215c94835bd7eccf36289927d526b4

Analysis

max time kernel
146s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 18:37

Target

dfd5482c71e9aec0010f828845839b27.exe
Size

76KB
MD5

dfd5482c71e9aec0010f828845839b27
SHA1

6ebae3f645adf6c7247f69ee6cec9b5af518d33c
SHA256

e4e106ee997ade1dcd69db69d87d8c9b46215c94835bd7eccf36289927d526b4
SHA512

e88987d1c5041126cd1789a2b5c3f43ad3dd6f1e1b5be0b8d3a87fdc9fe8dbc21d7048561afb9278464f139b6f41e97b10354d830a3cd92854bf10dc202b8010
SSDEEP

1536:2/ePyXHZ7DA4BfBrmTiXvvvUgbFNCuACP1DIgN:UeSHZ7DTBfBrB/UgbFNCuAq2C

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2496	1764	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 2496	1764	dfd5482c71e9aec0010f828845839b27.exe	28
PID 1764 wrote to memory of 2496	1764	dfd5482c71e9aec0010f828845839b27.exe	28
PID 1764 wrote to memory of 2496	1764	dfd5482c71e9aec0010f828845839b27.exe	28
PID 1764 wrote to memory of 2496	1764	dfd5482c71e9aec0010f828845839b27.exe	28

C:\Users\Admin\AppData\Local\Temp\dfd5482c71e9aec0010f828845839b27.exe
"C:\Users\Admin\AppData\Local\Temp\dfd5482c71e9aec0010f828845839b27.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 108
  2⤵
  - Program crash
  PID:2496

memory/1764-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1764-1-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download