86e4b7d51a27ce3fec47bf784320f903b213d824927665819e716ddcfb4c3366

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16-07-2023 17:03

Target

7ae48a1d76e573_JC.exe
Size

335KB
MD5

7ae48a1d76e573335d06daefed349417
SHA1

1db74cfc726b1cda66e7b22b37285fbfcd237d65
SHA256

86e4b7d51a27ce3fec47bf784320f903b213d824927665819e716ddcfb4c3366
SHA512

d0e09c18a2305e4ef63aa99fa82ecbce1a84306b12b50a85f59bb296d70e7a60fb6477c2116b09fefd5e7c0c35fe806e93d71d1fadc6f23f72e8b7ae7fe20457
SSDEEP

6144:qtUGfUWOeEBUEhLkXj3zRG6yLQ/UNP4H2CiTTp10qhh4B+Ajrt:qtUGfVwUFzRG6EQ0POfiTTf0qpAjrt

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2988 2576 WerFault.exe 7ae48a1d76e573_JC.exe

pid	pid_target	process	target process
2988	2576	WerFault.exe	7ae48a1d76e573_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7ae48a1d76e573_JC.exe

description	pid	process	target process
PID 2576 wrote to memory of 2988	2576	7ae48a1d76e573_JC.exe	WerFault.exe
PID 2576 wrote to memory of 2988	2576	7ae48a1d76e573_JC.exe	WerFault.exe
PID 2576 wrote to memory of 2988	2576	7ae48a1d76e573_JC.exe	WerFault.exe
PID 2576 wrote to memory of 2988	2576	7ae48a1d76e573_JC.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7ae48a1d76e573_JC.exe
"C:\Users\Admin\AppData\Local\Temp\7ae48a1d76e573_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 120
2⤵
- Program crash
PID:2988