5193cff85a10f7b63545e43008120a6cd3924d83090a5291e7ded9ac497b545d

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/06/2023, 08:24

Target

zTransmissionService.exe
Size

8KB
MD5

2cf25567387ebdc7d86562ec169f778d
SHA1

2f0c41f7731233f9bc16963715caf2def5960205
SHA256

5193cff85a10f7b63545e43008120a6cd3924d83090a5291e7ded9ac497b545d
SHA512

0ac695a05c5ec00ca10dda03067404bf814306d9ab950af7748f8fc1b4c0e69cadbd30f3ba14e84f47920727042e033158d27ce5194540c2ed7d67d3696c1052
SSDEEP

96:QOaDpSEm+XZEYHoSBBZSlu+T+TEHPuMZLWzMFHDw8qWDDIzNt:QOFUXZEYoSBTSIi+KPuMZNF08qWHK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	912	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1992	912	zTransmissionService.exe	26
PID 912 wrote to memory of 1992	912	zTransmissionService.exe	26
PID 912 wrote to memory of 1992	912	zTransmissionService.exe	26
PID 912 wrote to memory of 1992	912	zTransmissionService.exe	26

C:\Users\Admin\AppData\Local\Temp\zTransmissionService.exe
"C:\Users\Admin\AppData\Local\Temp\zTransmissionService.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 540
  2⤵
  - Program crash
  PID:1992

memory/912-54-0x0000000000CE0000-0x0000000000CE8000-memory.dmp

Filesize
32KB

Download