b8b75479747af7f1297ea932b29ff54d25b11e473d40054ddd5bfb2f1f709f27

Analysis

max time kernel
26s
max time network
29s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
27/06/2023, 07:25

Target
79b8eb1674365a607baa86f8274b8f7c.exe
Size 496KB
Sample230627-h8y1asdd67
SHA256 b8b75479747af7f1297ea932b29ff54d25b11e473d40054ddd5bfb2f1f709f27
MD5 79b8eb1674365a607baa86f8274b8f7c
SHA1 c9e82a4be67bf69f176ec505fef9d417b4c5b5f2
SHA512 8d024e64e5199d09a3009bff3573e56c31e17d0981fd459c365c9b1923fd48bad331a156135ac6c1d364c29594f042c5d980c71f95e57818c5f28264a527be2f
SSDEEP 12288:aMnO803zFaxxVR9UEXirp4zO8cllkLX0ot:aMO80Za1R9UEkp4CFkLp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2016	1252	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 2016	1252	79b8eb1674365a607baa86f8274b8f7c.exe	27
PID 1252 wrote to memory of 2016	1252	79b8eb1674365a607baa86f8274b8f7c.exe	27
PID 1252 wrote to memory of 2016	1252	79b8eb1674365a607baa86f8274b8f7c.exe	27
PID 1252 wrote to memory of 2016	1252	79b8eb1674365a607baa86f8274b8f7c.exe	27

C:\Users\Admin\AppData\Local\Temp\79b8eb1674365a607baa86f8274b8f7c.exe
"C:\Users\Admin\AppData\Local\Temp\79b8eb1674365a607baa86f8274b8f7c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 112
  2⤵
  - Program crash
  PID:2016