f258901b9f7b8db84c8f83a005aecf5f83797d8be4b55e5366dd5139acc05ffb

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15-10-2023 22:27

Target

f258901b9f7b8db84c8f83a005aecf5f83797d8be4b55e5366dd5139acc05ffb.exe
Size

1.0MB
MD5

2210aecb492158d85f1cdff754eb9730
SHA1

9f87c4ba2fd38a7fe8e225bf1865faba7e7b82c6
SHA256

f258901b9f7b8db84c8f83a005aecf5f83797d8be4b55e5366dd5139acc05ffb
SHA512

41efac99b99996d110c42e3dd7afc604ab50fe6c66770a8e42fac428967a6eb57cc6934f08fec18b83f673159180d8603df71a510782e54c325cb5f7f8ccffe1
SSDEEP

12288:r7DsAxREsrUcKpS50hmzUiTCujpUtKDII7zxG9aKC2emYujQ5uK8zp3gFNHZfo3:TsAxysrUcKpS63WCQHxG9alFuwfH1o3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2968	2776	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2968	2776	f258901b9f7b8db84c8f83a005aecf5f83797d8be4b55e5366dd5139acc05ffb.exe	29
PID 2776 wrote to memory of 2968	2776	f258901b9f7b8db84c8f83a005aecf5f83797d8be4b55e5366dd5139acc05ffb.exe	29
PID 2776 wrote to memory of 2968	2776	f258901b9f7b8db84c8f83a005aecf5f83797d8be4b55e5366dd5139acc05ffb.exe	29
PID 2776 wrote to memory of 2968	2776	f258901b9f7b8db84c8f83a005aecf5f83797d8be4b55e5366dd5139acc05ffb.exe	29

C:\Users\Admin\AppData\Local\Temp\f258901b9f7b8db84c8f83a005aecf5f83797d8be4b55e5366dd5139acc05ffb.exe
"C:\Users\Admin\AppData\Local\Temp\f258901b9f7b8db84c8f83a005aecf5f83797d8be4b55e5366dd5139acc05ffb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 36
  2⤵
  - Program crash
  PID:2968

memory/2776-0-0x0000000000030000-0x0000000000188000-memory.dmp

Filesize
1.3MB

Download
memory/2776-1-0x0000000000030000-0x0000000000188000-memory.dmp

Filesize
1.3MB

Download