79216574907e890b81ef15ab90f701219ffab5b9105d351f1c1908adaff5fe4b

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
14/07/2023, 12:31

Target
8926a2dcab9083471a74784240d9f1af.exe
Size 1.7MB
Sample230714-pp2qeadf76
SHA256 79216574907e890b81ef15ab90f701219ffab5b9105d351f1c1908adaff5fe4b
MD5 8926a2dcab9083471a74784240d9f1af
SHA1 519a0303abfc7b900ea3740206cdf75e32671f08
SHA512 496c4e5102f50bfeda5652263ed54edeca03d25a813b4b907d2820ed6b758307d584ffc9e99e56dda29b738484c6d06d66300cb2fc1adcc21cc1b1ff805c23a0
SSDEEP 24576:bJofBUs+b/QwEpl6eCKIwlYUb5wUxO+kjFyEwHWbO66teUeXFYqXBbVTb34k30/V:1KBDwSl6e0wlYUtwUxOrAuFykji9
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2596	3048	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2596	3048	8926a2dcab9083471a74784240d9f1af.exe	29
PID 3048 wrote to memory of 2596	3048	8926a2dcab9083471a74784240d9f1af.exe	29
PID 3048 wrote to memory of 2596	3048	8926a2dcab9083471a74784240d9f1af.exe	29
PID 3048 wrote to memory of 2596	3048	8926a2dcab9083471a74784240d9f1af.exe	29

C:\Users\Admin\AppData\Local\Temp\8926a2dcab9083471a74784240d9f1af.exe
"C:\Users\Admin\AppData\Local\Temp\8926a2dcab9083471a74784240d9f1af.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 56
  2⤵
  - Program crash
  PID:2596

memory/3048-54-0x0000000000400000-0x0000000000549000-memory.dmp

Download

memory/3048-55-0x0000000000400000-0x0000000000549000-memory.dmp

Download