8c3e285ce33109e438b98d6715de7ba961b1e896f165634f8ca5aa7ee30b0d59

Analysis

max time kernel
142s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15/10/2023, 19:40

Target

7e61bb00e89e01e610dcfc7cae1b5d30_exe32.exe
Size

575KB
MD5

7e61bb00e89e01e610dcfc7cae1b5d30
SHA1

2061d8feb89b291434a847dca8dd1f70c2840cb0
SHA256

8c3e285ce33109e438b98d6715de7ba961b1e896f165634f8ca5aa7ee30b0d59
SHA512

3521b294ba527b16ee702a4611ee93af43951b42be0346a711770364bd06858621dd923cd50d754fcce83d3572ce581a777dc9c9ca0d50eaad37f518dde2ec87
SSDEEP

6144:gIjPjjJmJPUcjy022w0XzJchzmUr29UYuo2LcYeFjdgPzNt9opQBg+Y/:NhI9uTpaJSzmguUYuo2LUmoTX/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1732	3028	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1732	3028	7e61bb00e89e01e610dcfc7cae1b5d30_exe32.exe	28
PID 3028 wrote to memory of 1732	3028	7e61bb00e89e01e610dcfc7cae1b5d30_exe32.exe	28
PID 3028 wrote to memory of 1732	3028	7e61bb00e89e01e610dcfc7cae1b5d30_exe32.exe	28
PID 3028 wrote to memory of 1732	3028	7e61bb00e89e01e610dcfc7cae1b5d30_exe32.exe	28

C:\Users\Admin\AppData\Local\Temp\7e61bb00e89e01e610dcfc7cae1b5d30_exe32.exe
"C:\Users\Admin\AppData\Local\Temp\7e61bb00e89e01e610dcfc7cae1b5d30_exe32.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 36
  2⤵
  - Program crash
  PID:1732

memory/3028-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3028-1-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download