3e432fb0165377d4faed9fb0bdddbac452b8f0ddae73f27c91b003d1b4b42109

Analysis

max time kernel
18s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 22:14

Target

1475b319eaa10ae13acaab2d6530d000N.exe
Size

472KB
MD5

1475b319eaa10ae13acaab2d6530d000
SHA1

1911af5955caa54e921c00506d7bf0431aea6bd1
SHA256

3e432fb0165377d4faed9fb0bdddbac452b8f0ddae73f27c91b003d1b4b42109
SHA512

bc765d53c55ac834256f7390d3d28dc230d1fb35ee65f4475553e2ef5ebce1fad5c40eaa599c1538173ff4cfe83674dd4e9e45daef1ef67242f7d032af62ccce
SSDEEP

3072:+E18RinudiP52xx67lLdJiHDosEyEWB0BVY5DsZeBHmRQ8:skgiPA6R7PgmBigR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2588	2504	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2588	2504	1475b319eaa10ae13acaab2d6530d000N.exe	30
PID 2504 wrote to memory of 2588	2504	1475b319eaa10ae13acaab2d6530d000N.exe	30
PID 2504 wrote to memory of 2588	2504	1475b319eaa10ae13acaab2d6530d000N.exe	30
PID 2504 wrote to memory of 2588	2504	1475b319eaa10ae13acaab2d6530d000N.exe	30

C:\Users\Admin\AppData\Local\Temp\1475b319eaa10ae13acaab2d6530d000N.exe
"C:\Users\Admin\AppData\Local\Temp\1475b319eaa10ae13acaab2d6530d000N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 36
  2⤵
  - Program crash
  PID:2588

memory/2504-1-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download