9e2c6f27837afeb7dddd866b3dd099887335643d61c6a1fcc1bde9683fc0dd7a

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 19:32

Target

NJGPSServer.exe
Size

31KB
MD5

05106399fc6123c71fd598adda178ed3
SHA1

406d1c48f01ac4298fd2d967046c8bdd1c11efa4
SHA256

9e2c6f27837afeb7dddd866b3dd099887335643d61c6a1fcc1bde9683fc0dd7a
SHA512

f8390711686ab5be6051fb4e674c9fa08de9fb1af7baa26ca025eb32946b19a6e8e00608aa70ba084c866282a93a2ac1e248f12833b89220a831c10f15afe29d
SSDEEP

384:gy86JgyPZhggOgKgf7kdVnq3AdB/PQ8cBkq7n2WTaHh8uH8vwsIfirnEjC+rs1Gw:nAgfAs8XkP729Hh3H9cl+rs1vnJV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3064	2064	WerFault.exe	24

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 3064	2064	NJGPSServer.exe	29
PID 2064 wrote to memory of 3064	2064	NJGPSServer.exe	29
PID 2064 wrote to memory of 3064	2064	NJGPSServer.exe	29
PID 2064 wrote to memory of 3064	2064	NJGPSServer.exe	29

C:\Users\Admin\AppData\Local\Temp\NJGPSServer.exe
"C:\Users\Admin\AppData\Local\Temp\NJGPSServer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 544
  2⤵
  - Program crash
  PID:3064

memory/2064-0-0x0000000000D10000-0x0000000000D1E000-memory.dmp

Filesize
56KB

Download
memory/2064-1-0x0000000074AF0000-0x00000000751DE000-memory.dmp

Filesize
6.9MB

Download
memory/2064-2-0x0000000074AF0000-0x00000000751DE000-memory.dmp

Filesize
6.9MB

Download