24de29d507beef0e417883a7246726faf91364b1c30aa36bb2398e4c0f316ffd

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 11:22

Target

1a7a5d49c360d5e24683baa3b7022cc7.exe
Size

566KB
MD5

1a7a5d49c360d5e24683baa3b7022cc7
SHA1

73b0469e636a6dff1c5b961d203c2510978fd97c
SHA256

24de29d507beef0e417883a7246726faf91364b1c30aa36bb2398e4c0f316ffd
SHA512

662ffaf1998024d0ee74b4eeacf0d7c1365a1154d19490c7b4fafbe88c5681f2f7a17132e3cf4570f741ef90f4a1ce558cf3d11058c36e1b7e81d1d3f827a705
SSDEEP

12288:NDf/Zg4N4MKZXR53xD8EHYhOkcSuLT9ukeAESAkDsxydHBtu/811KEd9vUnmmaTo:NDHvKZXR5BSOkcSuLJukvABYHCU11K0c

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2936	2668	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2936	2668	1a7a5d49c360d5e24683baa3b7022cc7.exe	28
PID 2668 wrote to memory of 2936	2668	1a7a5d49c360d5e24683baa3b7022cc7.exe	28
PID 2668 wrote to memory of 2936	2668	1a7a5d49c360d5e24683baa3b7022cc7.exe	28
PID 2668 wrote to memory of 2936	2668	1a7a5d49c360d5e24683baa3b7022cc7.exe	28

C:\Users\Admin\AppData\Local\Temp\1a7a5d49c360d5e24683baa3b7022cc7.exe
"C:\Users\Admin\AppData\Local\Temp\1a7a5d49c360d5e24683baa3b7022cc7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 152
  2⤵
  - Program crash
  PID:2936

memory/2668-0-0x0000000000210000-0x0000000000277000-memory.dmp

Filesize
412KB

Download
memory/2668-1-0x0000000000210000-0x0000000000277000-memory.dmp

Filesize
412KB

Download