4fc57cfe6ad19b764721faf9215457a09ddeebc7402c8833f290181af0b20d5e

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 20:53

Target

z34PDnVzyEItkXaInw.exe
Size

772KB
MD5

c85149f68536d2bccb60ad32e88d6895
SHA1

703e4b9d6db31ad5b83048b3ebf2fea81492df02
SHA256

4fc57cfe6ad19b764721faf9215457a09ddeebc7402c8833f290181af0b20d5e
SHA512

a766ce5265f8a33eb86fe2686a7a02d6df5661c4a7859ff9cc05c10f41d3600bf55f9fcee76197010d0b1d27b4d76e64df3de5143cf4ec8a6a34299362d0db7c
SSDEEP

24576:3/zD1ArxfnREzkQsImlHqocz5dqIzmarw7w:3/tixfmYQsxFPudLSar

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3008	2820	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 3008	2820	z34PDnVzyEItkXaInw.exe	28
PID 2820 wrote to memory of 3008	2820	z34PDnVzyEItkXaInw.exe	28
PID 2820 wrote to memory of 3008	2820	z34PDnVzyEItkXaInw.exe	28
PID 2820 wrote to memory of 3008	2820	z34PDnVzyEItkXaInw.exe	28

C:\Users\Admin\AppData\Local\Temp\z34PDnVzyEItkXaInw.exe
"C:\Users\Admin\AppData\Local\Temp\z34PDnVzyEItkXaInw.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 788
  2⤵
  - Program crash
  PID:3008

memory/2820-0-0x00000000013C0000-0x0000000001488000-memory.dmp

Filesize
800KB

Download
memory/2820-1-0x0000000074E50000-0x000000007553E000-memory.dmp

Filesize
6.9MB

Download
memory/2820-2-0x0000000000B20000-0x0000000000B60000-memory.dmp

Filesize
256KB

Download
memory/2820-3-0x0000000001220000-0x00000000012C0000-memory.dmp

Filesize
640KB

Download
memory/2820-4-0x00000000005D0000-0x00000000005E2000-memory.dmp

Filesize
72KB

Download
memory/2820-5-0x0000000000A30000-0x0000000000A38000-memory.dmp

Filesize
32KB

Download
memory/2820-6-0x0000000000A50000-0x0000000000A5C000-memory.dmp

Filesize
48KB

Download
memory/2820-7-0x0000000074E50000-0x000000007553E000-memory.dmp

Filesize
6.9MB

Download
memory/2820-8-0x0000000000B20000-0x0000000000B60000-memory.dmp

Filesize
256KB

Download