1d6cfb4a7ff760be78907bfed0b1604da3b0f8e4bac0c9205706beac7e60c6ac

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/06/2023, 16:38

Target

WagasServiceold.exe
Size

182KB
MD5

92b72c4c8897603b19d9041e833da474
SHA1

57e74d2030cddf2dae9b322ce46179815ebb52e4
SHA256

1d6cfb4a7ff760be78907bfed0b1604da3b0f8e4bac0c9205706beac7e60c6ac
SHA512

350d813767d024de6f2903cac3fc6365c5298616cdb599d4463f2995fc5af2f1a1512a8a397ba82cd078f5845cb34e46ea3a9b35b4a95d3a6e90b580f76b0beb
SSDEEP

1536:GKzLiiE72JJZnErNd+4+HLPX+dwukzoUxC/LBpXdtMr7LvaZXfbddoNmFWlz/IS6:92QniWRLOmdzjIXNtUUXfbddoNmFjb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1596	1932	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1596	1932	WagasServiceold.exe	28
PID 1932 wrote to memory of 1596	1932	WagasServiceold.exe	28
PID 1932 wrote to memory of 1596	1932	WagasServiceold.exe	28
PID 1932 wrote to memory of 1596	1932	WagasServiceold.exe	28

C:\Users\Admin\AppData\Local\Temp\WagasServiceold.exe
"C:\Users\Admin\AppData\Local\Temp\WagasServiceold.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 536
  2⤵
  - Program crash
  PID:1596

memory/1932-54-0x0000000000200000-0x0000000000234000-memory.dmp

Filesize
208KB

Download