2de2134a2b6d2c8aeb45c4c4223402d01417a61e9a81b8dd078393f5e9c7c938

Analysis

max time kernel
1s
max time network
2s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 16:06

Target
SoftWare(1).exe
Size 462KB
Sample240531-tkf1cseb66
SHA256 4a543f647d662ad43b70f3fa7171aa2f73842f3c132eb54c0acc88802bd66275
MD5 785f8009ad61ad2564df3ff47eb54c8f
SHA1 6ee6a0c06897e559f7302ed28ba9002639f95598
SHA512 aada532b660d3dce0b4e08b54170741d0cd16c5426107f61be2c1b50754c87ce5373734fe552ae19e6ab4c2726ba9e3393672e009c77d0f871eeebc6acc964df
SSDEEP 6144:H/loNDtJ/rTQMHrFGOqZbR7AY1o9WWHyqvJtWxJ+jB8wDZSYTtiX2I2l3mIjsVEq:yNRJ/oMPweyqGa8wPekgIjsCkDUC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2184	1312	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 2184	1312	SoftWare(1).exe	28
PID 1312 wrote to memory of 2184	1312	SoftWare(1).exe	28
PID 1312 wrote to memory of 2184	1312	SoftWare(1).exe	28
PID 1312 wrote to memory of 2184	1312	SoftWare(1).exe	28

C:\Users\Admin\AppData\Local\Temp\SoftWare(1).exe
"C:\Users\Admin\AppData\Local\Temp\SoftWare(1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 72
  2⤵
  - Program crash
  PID:2184

memory/1312-0-0x0000000000020000-0x0000000000021000-memory.dmp

Download

memory/1312-1-0x0000000000020000-0x0000000000021000-memory.dmp

Download