0688ba7056b1a00d52b68538fec4a400d80682c9f7effcfb9f9ece4ba1f145f5

Analysis

max time kernel
27s
max time network
31s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
08/07/2023, 16:46

Target

7fc1a1424a146aexeexeexeex.exe
Size

335KB
MD5

7fc1a1424a146a3628eb19eaca291563
SHA1

b4f163d7da75f413fca660cc1ec48b5c4c654262
SHA256

0688ba7056b1a00d52b68538fec4a400d80682c9f7effcfb9f9ece4ba1f145f5
SHA512

bbe8aa88d868a3683bee1bd759a0dd1f369281a7c3592fcb5adabb05da6844460ac0a84e25709eb48db658a634b9b081cbe4d443cca843d202255c4846cc35f5
SSDEEP

6144:qtUGfUWOeEBUEhLkXj3zRG6yLQ/UNP4H2CiTTE10qhh4QAjrt:qtUGfVwUFzRG6EQ0POfiTTE0qFAjrt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1760	1260	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 1760	1260	7fc1a1424a146aexeexeexeex.exe	28
PID 1260 wrote to memory of 1760	1260	7fc1a1424a146aexeexeexeex.exe	28
PID 1260 wrote to memory of 1760	1260	7fc1a1424a146aexeexeexeex.exe	28
PID 1260 wrote to memory of 1760	1260	7fc1a1424a146aexeexeexeex.exe	28

C:\Users\Admin\AppData\Local\Temp\7fc1a1424a146aexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\7fc1a1424a146aexeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 120
  2⤵
  - Program crash
  PID:1760