c4193cd5a72e0ac786e4bd3bf4ee44ff4af3eca8f5fea05cf4fc1d27e0934681

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 12:59

Target

58c48e2b1d3d26ac96cebf8c114750582d4cdeef46a05bbf706c4b4630c541ff.exe
Size

234KB
MD5

d0492d61a010c75b69a21b31761ac655
SHA1

0168759aebd253fed1dd89a44d260f6eadc94a2d
SHA256

58c48e2b1d3d26ac96cebf8c114750582d4cdeef46a05bbf706c4b4630c541ff
SHA512

e4552a5bcf7f6b7911a87873d6d168d44f4ab0f351c822b5ec3b14b5db359ce0fadecac7bc032111197243b79047cbe1203e4fa9afc558c9f9e2a0ecb28eb52d
SSDEEP

6144:AhAZ0mc86LHVUCAlfzHORKOrfIrIEgcNxHookuvxNimwE5R:ImcJLHVpAl7o3rfwrYt+7/r

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3048	1368	WerFault.exe	27

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2744	1368	58c48e2b1d3d26ac96cebf8c114750582d4cdeef46a05bbf706c4b4630c541ff.exe	29
PID 1368 wrote to memory of 2744	1368	58c48e2b1d3d26ac96cebf8c114750582d4cdeef46a05bbf706c4b4630c541ff.exe	29
PID 1368 wrote to memory of 2744	1368	58c48e2b1d3d26ac96cebf8c114750582d4cdeef46a05bbf706c4b4630c541ff.exe	29
PID 1368 wrote to memory of 2744	1368	58c48e2b1d3d26ac96cebf8c114750582d4cdeef46a05bbf706c4b4630c541ff.exe	29
PID 1368 wrote to memory of 2744	1368	58c48e2b1d3d26ac96cebf8c114750582d4cdeef46a05bbf706c4b4630c541ff.exe	29
PID 1368 wrote to memory of 2744	1368	58c48e2b1d3d26ac96cebf8c114750582d4cdeef46a05bbf706c4b4630c541ff.exe	29
PID 1368 wrote to memory of 2744	1368	58c48e2b1d3d26ac96cebf8c114750582d4cdeef46a05bbf706c4b4630c541ff.exe	29
PID 1368 wrote to memory of 3048	1368	58c48e2b1d3d26ac96cebf8c114750582d4cdeef46a05bbf706c4b4630c541ff.exe	30
PID 1368 wrote to memory of 3048	1368	58c48e2b1d3d26ac96cebf8c114750582d4cdeef46a05bbf706c4b4630c541ff.exe	30
PID 1368 wrote to memory of 3048	1368	58c48e2b1d3d26ac96cebf8c114750582d4cdeef46a05bbf706c4b4630c541ff.exe	30
PID 1368 wrote to memory of 3048	1368	58c48e2b1d3d26ac96cebf8c114750582d4cdeef46a05bbf706c4b4630c541ff.exe	30
PID 1368 wrote to memory of 2744	1368	58c48e2b1d3d26ac96cebf8c114750582d4cdeef46a05bbf706c4b4630c541ff.exe	29

C:\Users\Admin\AppData\Local\Temp\58c48e2b1d3d26ac96cebf8c114750582d4cdeef46a05bbf706c4b4630c541ff.exe
"C:\Users\Admin\AppData\Local\Temp\58c48e2b1d3d26ac96cebf8c114750582d4cdeef46a05bbf706c4b4630c541ff.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 508
  2⤵
  - Program crash
  PID:3048

memory/1368-0-0x0000000000AF0000-0x0000000000B2C000-memory.dmp

Filesize
240KB

Download
memory/1368-1-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/1368-5-0x00000000020D0000-0x00000000040D0000-memory.dmp

Filesize
32.0MB

Download
memory/1368-9-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/1368-10-0x00000000020D0000-0x00000000040D0000-memory.dmp

Filesize
32.0MB

Download
memory/2744-4-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download
memory/2744-7-0x0000000000400000-0x0000000000648000-memory.dmp

Filesize
2.3MB

Download