79216574907e890b81ef15ab90f701219ffab5b9105d351f1c1908adaff5fe4b

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
14-07-2023 12:31

Target

8926a2dcab9083471a74784240d9f1af.exe
Size

1.7MB
MD5

8926a2dcab9083471a74784240d9f1af
SHA1

519a0303abfc7b900ea3740206cdf75e32671f08
SHA256

79216574907e890b81ef15ab90f701219ffab5b9105d351f1c1908adaff5fe4b
SHA512

496c4e5102f50bfeda5652263ed54edeca03d25a813b4b907d2820ed6b758307d584ffc9e99e56dda29b738484c6d06d66300cb2fc1adcc21cc1b1ff805c23a0
SSDEEP

24576:bJofBUs+b/QwEpl6eCKIwlYUb5wUxO+kjFyEwHWbO66teUeXFYqXBbVTb34k30/V:1KBDwSl6e0wlYUtwUxOrAuFykji9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1488	532	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 1488	532	8926a2dcab9083471a74784240d9f1af.exe	29
PID 532 wrote to memory of 1488	532	8926a2dcab9083471a74784240d9f1af.exe	29
PID 532 wrote to memory of 1488	532	8926a2dcab9083471a74784240d9f1af.exe	29
PID 532 wrote to memory of 1488	532	8926a2dcab9083471a74784240d9f1af.exe	29

C:\Users\Admin\AppData\Local\Temp\8926a2dcab9083471a74784240d9f1af.exe
"C:\Users\Admin\AppData\Local\Temp\8926a2dcab9083471a74784240d9f1af.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 56
  2⤵
  - Program crash
  PID:1488

memory/532-54-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/532-55-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download