66b13b0fed13f5f9773d95d764be1f9072391a3c71d789cf2fb438920566ffcf

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 17:10

Target

079eebe4d0d99fe62fc8554baf5d5443.exe
Size

118KB
MD5

079eebe4d0d99fe62fc8554baf5d5443
SHA1

6fb45c9683f53bcb8102bc522d843258c68ea71d
SHA256

66b13b0fed13f5f9773d95d764be1f9072391a3c71d789cf2fb438920566ffcf
SHA512

6777595f208a1432ba8f8df285f92c853b006b147868ace407f3767cd18d34faacdea3fba3c71869a388b1b8bee451adff6aa6f0df3fd04968c43c59c4f78111
SSDEEP

1536:ONs2UxNbNQSITk5JC7dbTi5aNGcfUNSTIEkA4BKQpNNA4WHo/bpTpf6g1UReIK2Z:nxNaSIaJC7A5ExHk/YHYFTH6LoS0y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
3012	3044	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 3012	3044	079eebe4d0d99fe62fc8554baf5d5443.exe	16
PID 3044 wrote to memory of 3012	3044	079eebe4d0d99fe62fc8554baf5d5443.exe	16
PID 3044 wrote to memory of 3012	3044	079eebe4d0d99fe62fc8554baf5d5443.exe	16
PID 3044 wrote to memory of 3012	3044	079eebe4d0d99fe62fc8554baf5d5443.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 92
1⤵
- Program crash
PID:3012

C:\Users\Admin\AppData\Local\Temp\079eebe4d0d99fe62fc8554baf5d5443.exe
"C:\Users\Admin\AppData\Local\Temp\079eebe4d0d99fe62fc8554baf5d5443.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3044