15590541344eb2888411857f081c9126dbf7e48ad0f60eb2561ede009de1aa85

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 11:12

Target

a486d7272e7768bebaa8ed0951d0f8d0N.exe
Size

320KB
MD5

a486d7272e7768bebaa8ed0951d0f8d0
SHA1

38c0e4c22d60c64400486f36a6fbcf75576bbc35
SHA256

15590541344eb2888411857f081c9126dbf7e48ad0f60eb2561ede009de1aa85
SHA512

a59bcf73d135a592350399dadf94ef2b19b0854885f714b03db775895f517e277d8013329744e46b51bf4f4d66153eb95c6cdc6e18ff23f3dfb9801462d9fbf1
SSDEEP

6144:+Ek5fXg1iUkH2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:1IXg19C2EB0NxDIBuOFe7/uT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2852	2624	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2852	2624	a486d7272e7768bebaa8ed0951d0f8d0N.exe	30
PID 2624 wrote to memory of 2852	2624	a486d7272e7768bebaa8ed0951d0f8d0N.exe	30
PID 2624 wrote to memory of 2852	2624	a486d7272e7768bebaa8ed0951d0f8d0N.exe	30
PID 2624 wrote to memory of 2852	2624	a486d7272e7768bebaa8ed0951d0f8d0N.exe	30

C:\Users\Admin\AppData\Local\Temp\a486d7272e7768bebaa8ed0951d0f8d0N.exe
"C:\Users\Admin\AppData\Local\Temp\a486d7272e7768bebaa8ed0951d0f8d0N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 36
  2⤵
  - Program crash
  PID:2852

memory/2624-0-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download