7fea10b1d0d9e53fea47320db726fc0107c85c6bc4baaa20e4070192b3825a6c

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15/10/2023, 19:46

Target

d04af2587355db05ebe1de82017f5d50_exe32.exe
Size

628KB
MD5

d04af2587355db05ebe1de82017f5d50
SHA1

1a9d88a27129099efd7a73b6ffd557bc34d66737
SHA256

7fea10b1d0d9e53fea47320db726fc0107c85c6bc4baaa20e4070192b3825a6c
SHA512

b41c4227338957df85d18eed01609018ab11f88e4fa49f1f303d4b689603a3bcf8e9d8c969c274bc172575709bc4b988bf025d10bad9d9b05ace6b4e8130e1f5
SSDEEP

6144:wqDAwl0xPTMiR9JSSxPUKPdodHheV/Hwz4zmpPNip3:w+67XR9JSSxvPdodHhIHufPNe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2152	1924	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2152	1924	d04af2587355db05ebe1de82017f5d50_exe32.exe	14
PID 1924 wrote to memory of 2152	1924	d04af2587355db05ebe1de82017f5d50_exe32.exe	14
PID 1924 wrote to memory of 2152	1924	d04af2587355db05ebe1de82017f5d50_exe32.exe	14
PID 1924 wrote to memory of 2152	1924	d04af2587355db05ebe1de82017f5d50_exe32.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 36
1⤵
- Program crash
PID:2152

C:\Users\Admin\AppData\Local\Temp\d04af2587355db05ebe1de82017f5d50_exe32.exe
"C:\Users\Admin\AppData\Local\Temp\d04af2587355db05ebe1de82017f5d50_exe32.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924