a267f26e34ab63bca70dff430eb6679dc771f5c9900617fc7b396c1c57709d40

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 06:42

Target

e104769c2b2a9f1aa592b624aae10464.exe
Size

427KB
MD5

e104769c2b2a9f1aa592b624aae10464
SHA1

5d049a56a7ef8d6250b8f31e5bdbdd061b17cf88
SHA256

a267f26e34ab63bca70dff430eb6679dc771f5c9900617fc7b396c1c57709d40
SHA512

d2d8ff36cf715f02cc1274a30a36b03e5f297915dc587f17def0fe6521890df4cf7f4e6bd0bbd991073b403518263ed29089b225a6c11c15fb17ff9c0cbb3c4c
SSDEEP

6144:aiFUvYoYDm5v8DJtBTd8dbVTh2adDWAzuroj3zjlYL1Q3RZ:aigYLm5EDJtBJ8hrlurovhfRZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	2740	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 1696	2740	e104769c2b2a9f1aa592b624aae10464.exe	28
PID 2740 wrote to memory of 1696	2740	e104769c2b2a9f1aa592b624aae10464.exe	28
PID 2740 wrote to memory of 1696	2740	e104769c2b2a9f1aa592b624aae10464.exe	28
PID 2740 wrote to memory of 1696	2740	e104769c2b2a9f1aa592b624aae10464.exe	28

C:\Users\Admin\AppData\Local\Temp\e104769c2b2a9f1aa592b624aae10464.exe
"C:\Users\Admin\AppData\Local\Temp\e104769c2b2a9f1aa592b624aae10464.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 116
  2⤵
  - Program crash
  PID:1696

memory/2740-0-0x0000000000190000-0x00000000001FF000-memory.dmp

Filesize
444KB

Download