ef50d8567413214182416c6ad85c5a7963847330a61cfe2fe5192202251c4299

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 00:02

Target

e0496f687d75420ea8dba5c507eeaa8a.exe
Size

115KB
MD5

e0496f687d75420ea8dba5c507eeaa8a
SHA1

adea247f0892c675ea1b37152206bd0cf913a552
SHA256

ef50d8567413214182416c6ad85c5a7963847330a61cfe2fe5192202251c4299
SHA512

46581bd8448479c61ecc8d178709063466168db5e56a47961691c35bdf247f53209a8db82a7dcb8236e038523d634c5cf5d5058dd9874163c35d4696378c8037
SSDEEP

3072:LhaG1nzMP9mLFk7B24ADs1N3lrps052gyaRVsw4LTysj:l3IlmhaoA1NlFsa2WVY7j

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2328	2028	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2328	2028	e0496f687d75420ea8dba5c507eeaa8a.exe	27
PID 2028 wrote to memory of 2328	2028	e0496f687d75420ea8dba5c507eeaa8a.exe	27
PID 2028 wrote to memory of 2328	2028	e0496f687d75420ea8dba5c507eeaa8a.exe	27
PID 2028 wrote to memory of 2328	2028	e0496f687d75420ea8dba5c507eeaa8a.exe	27

C:\Users\Admin\AppData\Local\Temp\e0496f687d75420ea8dba5c507eeaa8a.exe
"C:\Users\Admin\AppData\Local\Temp\e0496f687d75420ea8dba5c507eeaa8a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 36
  2⤵
  - Program crash
  PID:2328

memory/2028-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2028-1-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download