7c8aaa88dd30f1b0301e3aaf0da58cdea2dfa56c0eb3b35b68123ecdefdf59e9

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 15:03 UTC

Target

037f80f7eee792aa95886508fc3cf946.exe
Size

491KB
MD5

037f80f7eee792aa95886508fc3cf946
SHA1

01a824ae5b084b68ea0adb18720d6c6c318ea363
SHA256

7096865b32b903fa9cec066e310e02a337af3e16a1c504d24320879f15f85791
SHA512

c1287d9ca62169334cce6002d212cc6a7be724fe565f342985a9ab732da174233fdc1c4c0eb2dca67fd7c2fc063b579b64a9af8ae01edfeca56724338540b200
SSDEEP

12288:0Xy9hAFKE4WNEEGGi+nfs/3GXvPKy0/vi2p+wxpEtVjK+EvKRFn6PeMHf:d9/VsiukO/F0/v9+wxpEtVjK+EvKRFnW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2708	2980	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2708	2980	037f80f7eee792aa95886508fc3cf946.exe	29
PID 2980 wrote to memory of 2708	2980	037f80f7eee792aa95886508fc3cf946.exe	29
PID 2980 wrote to memory of 2708	2980	037f80f7eee792aa95886508fc3cf946.exe	29
PID 2980 wrote to memory of 2708	2980	037f80f7eee792aa95886508fc3cf946.exe	29

C:\Users\Admin\AppData\Local\Temp\037f80f7eee792aa95886508fc3cf946.exe
"C:\Users\Admin\AppData\Local\Temp\037f80f7eee792aa95886508fc3cf946.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 612
  2⤵
  - Program crash
  PID:2708

memory/2980-0-0x0000000000B60000-0x0000000000BE2000-memory.dmp

Filesize
520KB

Download
memory/2980-1-0x00000000749C0000-0x00000000750AE000-memory.dmp

Filesize
6.9MB

Download
memory/2980-2-0x0000000004BA0000-0x0000000004BE0000-memory.dmp

Filesize
256KB

Download
memory/2980-3-0x00000000009B0000-0x0000000000A24000-memory.dmp

Filesize
464KB

Download
memory/2980-4-0x00000000749C0000-0x00000000750AE000-memory.dmp

Filesize
6.9MB

Download
memory/2980-5-0x0000000004BA0000-0x0000000004BE0000-memory.dmp

Filesize
256KB

Download