26ae5e9d1e5b4cce78a18ac82166729d0925da9407090d545a4c1a1bad8343e2

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
24/07/2023, 12:52

Target

2023-07-14_f26dc426d49495e71e8aa0cf8c1061a0_stop.exe
Size

1.1MB
MD5

f26dc426d49495e71e8aa0cf8c1061a0
SHA1

a015d42c0c0f198dee57435cb71a3c3919158b07
SHA256

26ae5e9d1e5b4cce78a18ac82166729d0925da9407090d545a4c1a1bad8343e2
SHA512

1f0b8bd53ba1a153a76a3d7d62bf53d568b9dcd50619c9f58c10f677cec04fec824301f5a9544c8202f0fb85ecffd8465a8a439fc304cad1099319eda3fa58cd
SSDEEP

24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/VRPOO8a/HUq7:F0dwAYZt6C31WeTNRPOhafUq7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2348	2324	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2348	2324	2023-07-14_f26dc426d49495e71e8aa0cf8c1061a0_stop.exe	28
PID 2324 wrote to memory of 2348	2324	2023-07-14_f26dc426d49495e71e8aa0cf8c1061a0_stop.exe	28
PID 2324 wrote to memory of 2348	2324	2023-07-14_f26dc426d49495e71e8aa0cf8c1061a0_stop.exe	28
PID 2324 wrote to memory of 2348	2324	2023-07-14_f26dc426d49495e71e8aa0cf8c1061a0_stop.exe	28

C:\Users\Admin\AppData\Local\Temp\2023-07-14_f26dc426d49495e71e8aa0cf8c1061a0_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2023-07-14_f26dc426d49495e71e8aa0cf8c1061a0_stop.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 192
  2⤵
  - Program crash
  PID:2348