0879ac5f8e5392979033b168f9e8202dc430713f2e320b9cda84ff3e04e623d7

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 21:32

Target

3d9700ed922ce90ba18bbd71cb9e0a1e.exe
Size

41KB
MD5

3d9700ed922ce90ba18bbd71cb9e0a1e
SHA1

117e52527072aa089a8160148da001998dd110cb
SHA256

0879ac5f8e5392979033b168f9e8202dc430713f2e320b9cda84ff3e04e623d7
SHA512

a0a8310c01e3e406e827ec2137a835c770a06ba3f42905f074730f01379895df029a415d256783b1d56d3e96572b0cbb50c65d36aa8d9a2d7f3baa0668717c83
SSDEEP

768:fWiafXwcbU3MXWla6pb8DFc5LnGQgjX/KkUP1+1wEUaKRoh:fRazoMGla6e5c5L/gjvKkUP1HGa6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1108	1204	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1108	1204	3d9700ed922ce90ba18bbd71cb9e0a1e.exe	28
PID 1204 wrote to memory of 1108	1204	3d9700ed922ce90ba18bbd71cb9e0a1e.exe	28
PID 1204 wrote to memory of 1108	1204	3d9700ed922ce90ba18bbd71cb9e0a1e.exe	28
PID 1204 wrote to memory of 1108	1204	3d9700ed922ce90ba18bbd71cb9e0a1e.exe	28

C:\Users\Admin\AppData\Local\Temp\3d9700ed922ce90ba18bbd71cb9e0a1e.exe
"C:\Users\Admin\AppData\Local\Temp\3d9700ed922ce90ba18bbd71cb9e0a1e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 116
  2⤵
  - Program crash
  PID:1108

memory/1204-0-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download