f9806462f2e874fa6569393fe3ce60749c2b878151955c22c562ac023319eb51

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 11:48

Target

CustomModeApp.exe
Size

391KB
MD5

983bd3534df7ec35da770a52764fd1fd
SHA1

ca804d7bdfb29524f18aea15c6df4aa8245e0539
SHA256

f9806462f2e874fa6569393fe3ce60749c2b878151955c22c562ac023319eb51
SHA512

72a8ce7186b9590fcfac50108ff53cae0e86c2820abae851c28448ac1833d751e61efceefa49eaac62693999cc80edfd093ce8bf0cd3d3154fbe04024b09242a
SSDEEP

6144:CAEDvODvtMJfDVyhJWncd4jvsX5lXofODvtMJfDVChJW+6aGI:CAEDvMvt6fDVyvd3TXeMvt6fDVCSa1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2208	2380	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2208	2380	CustomModeApp.exe	28
PID 2380 wrote to memory of 2208	2380	CustomModeApp.exe	28
PID 2380 wrote to memory of 2208	2380	CustomModeApp.exe	28
PID 2380 wrote to memory of 2208	2380	CustomModeApp.exe	28

C:\Users\Admin\AppData\Local\Temp\CustomModeApp.exe
"C:\Users\Admin\AppData\Local\Temp\CustomModeApp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 656
  2⤵
  - Program crash
  PID:2208

memory/2380-0-0x0000000000960000-0x00000000009C4000-memory.dmp

Filesize
400KB

Download
memory/2380-1-0x0000000074860000-0x0000000074F4E000-memory.dmp

Filesize
6.9MB

Download
memory/2380-2-0x0000000004870000-0x00000000048B0000-memory.dmp

Filesize
256KB

Download
memory/2380-3-0x0000000074860000-0x0000000074F4E000-memory.dmp

Filesize
6.9MB

Download
memory/2380-4-0x0000000004870000-0x00000000048B0000-memory.dmp

Filesize
256KB

Download