c3695053ff475f57f3c74c8ed5583a142cfe936de2f5a3d81023880dbed2fbd2

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
08/08/2023, 05:44

Target

Verify.exe
Size

49KB
MD5

74fa7a1c7814cff573d224d7f23bf089
SHA1

38c3552b1b87e5397388c9ee2e90088b8a2b4514
SHA256

c3695053ff475f57f3c74c8ed5583a142cfe936de2f5a3d81023880dbed2fbd2
SHA512

f667e7c6d8329def7accab3e84cec37c0acb00db71929b46572766dcdaef9f2adee54a0c4e5f7d74c32ea2203260c7de9a532f0b13bfc39c070407c5dce6fc75
SSDEEP

384:XkXYJD5aKS/Xd4T/p5EK/whof4A9sYXZ99a+GcpMQiW4zmkZXOfq1UKKZkLMhPgH:X4KUgEGqoxs40XbOfq1mkgMnd0wt5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2184	2256	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2184	2256	Verify.exe	28
PID 2256 wrote to memory of 2184	2256	Verify.exe	28
PID 2256 wrote to memory of 2184	2256	Verify.exe	28

C:\Users\Admin\AppData\Local\Temp\Verify.exe
"C:\Users\Admin\AppData\Local\Temp\Verify.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2256 -s 536
  2⤵
  - Program crash
  PID:2184

memory/2256-54-0x0000000000F80000-0x0000000000F92000-memory.dmp

Filesize
72KB

Download
memory/2256-55-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

Filesize
9.9MB

Download
memory/2256-56-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

Filesize
9.9MB

Download