404d9d0c3796faaf5f40044cde6b4ed9d24a9146430a473429c32dbb7a0d268a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 06:42

Target

404d9d0c3796faaf5f40044cde6b4ed9d24a9146430a473429c32dbb7a0d268a.exe
Size

73KB
MD5

42610098567b22ede2e818bb55eb6f90
SHA1

a0fef16967fec2846870be32fa7db4f4746e3fdc
SHA256

404d9d0c3796faaf5f40044cde6b4ed9d24a9146430a473429c32dbb7a0d268a
SHA512

c2a9c9cd1b12109525c1ced67c24167dac59c16e71fbda557c8d6af67f254d0ca94bfc32e91af8e203c8683885284b87d5cf4905bc0e1e8e52b289c5f0478716
SSDEEP

1536:Um0ir9H5tlks7S789WJv7ld6nlII9+KOx96:Um0ir9H+an9lOx96

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3012	2692	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 3012	2692	404d9d0c3796faaf5f40044cde6b4ed9d24a9146430a473429c32dbb7a0d268a.exe	30
PID 2692 wrote to memory of 3012	2692	404d9d0c3796faaf5f40044cde6b4ed9d24a9146430a473429c32dbb7a0d268a.exe	30
PID 2692 wrote to memory of 3012	2692	404d9d0c3796faaf5f40044cde6b4ed9d24a9146430a473429c32dbb7a0d268a.exe	30
PID 2692 wrote to memory of 3012	2692	404d9d0c3796faaf5f40044cde6b4ed9d24a9146430a473429c32dbb7a0d268a.exe	30

C:\Users\Admin\AppData\Local\Temp\404d9d0c3796faaf5f40044cde6b4ed9d24a9146430a473429c32dbb7a0d268a.exe
"C:\Users\Admin\AppData\Local\Temp\404d9d0c3796faaf5f40044cde6b4ed9d24a9146430a473429c32dbb7a0d268a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 532
  2⤵
  - Program crash
  PID:3012

memory/2692-0-0x000000007457E000-0x000000007457F000-memory.dmp

Filesize
4KB

Download
memory/2692-1-0x00000000003C0000-0x00000000003D8000-memory.dmp

Filesize
96KB

Download
memory/2692-2-0x000000007457E000-0x000000007457F000-memory.dmp

Filesize
4KB

Download