7628bd65d73312bdb08ae234ebee5a67c8a8388229bdb744ecb4911dbd79b240

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/06/2023, 19:49

Target

CreateAllDataService.exe
Size

13KB
MD5

8531514480e57b2c4296d53e435eb59c
SHA1

afc4dddd5450c962fb436987821c039b29bb57ab
SHA256

7628bd65d73312bdb08ae234ebee5a67c8a8388229bdb744ecb4911dbd79b240
SHA512

362f3dea85370d72b1a3ec9dffcd93b3734f08c66cd40a2545cd8910273bb8dc35ec8cfaf43025200c2ba3905feaab279e4c55371febea837aa9ebe61cf343f5
SSDEEP

192:+8Pusau7yhgL2m4Hn2Nml917fZijH9/7mXT3VxQnqkd+CnKF6Zt4BWj2:+8PHyhgUHn2C9UH9/ez2QBWj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	1592	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 1696	1592	CreateAllDataService.exe	28
PID 1592 wrote to memory of 1696	1592	CreateAllDataService.exe	28
PID 1592 wrote to memory of 1696	1592	CreateAllDataService.exe	28

C:\Users\Admin\AppData\Local\Temp\CreateAllDataService.exe
"C:\Users\Admin\AppData\Local\Temp\CreateAllDataService.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1592 -s 520
  2⤵
  - Program crash
  PID:1696

memory/1592-54-0x00000000002B0000-0x00000000002BA000-memory.dmp

Filesize
40KB

Download