00cf24fb9b9dbd9bd5dd51a8f184da692b12dae89f433e8d016ab01dc19038d2

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/04/2023, 06:55

Target

SapArchiver.exe
Size

91KB
MD5

3aea7efb206d0e028732254cf763a174
SHA1

2623d1f0f312c716f815e409599f7d4ea51777de
SHA256

00cf24fb9b9dbd9bd5dd51a8f184da692b12dae89f433e8d016ab01dc19038d2
SHA512

9ead9148f4a969ced773bc64aa46bc4db791aae86de5a250c6ec75e5f09a6c821f17970bdfb2b7aec1b538828272e4edb5d41d99282fc84210e577a595dadfd2
SSDEEP

1536:dgLg/w6uTrTe7Jt9zH4/E9L95mAOhckPjhhhhhhhhhhhWBClPZOwpsdr2N:dgU46uTrTMDJYEFmAoZPjhhhhhhhhhh5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2044	928	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 2044	928	SapArchiver.exe	28
PID 928 wrote to memory of 2044	928	SapArchiver.exe	28
PID 928 wrote to memory of 2044	928	SapArchiver.exe	28

C:\Users\Admin\AppData\Local\Temp\SapArchiver.exe
"C:\Users\Admin\AppData\Local\Temp\SapArchiver.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 928 -s 540
  2⤵
  - Program crash
  PID:2044

memory/928-54-0x0000000000310000-0x000000000032A000-memory.dmp

Filesize
104KB

Download