77f1b4848ed3b8836188b50883b010e3c1410cddcb9299eb470dfc1b1b6b495e

Analysis

max time kernel
141s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 17:20

Target

3074966297cb98260bc507b7c535ae8c.exe
Size

38KB
MD5

3074966297cb98260bc507b7c535ae8c
SHA1

795b574488c6e3657fe876a987163d9fe6ef6bea
SHA256

77f1b4848ed3b8836188b50883b010e3c1410cddcb9299eb470dfc1b1b6b495e
SHA512

9752bf811dd81f528cdfdd072bbcbf3cb52dffb38c54d79e177312b61b9deb723acbc0e8067a3bcf2f1264f9ea8a538b81e6e75c747a3c96c886d7e11f4fb1e1
SSDEEP

768:FvL5G4j9TgHesUWgRQ52FuWaCKKvPGA1wEZJF4f5zzfDdrmV85Gj:ZtEw1xaC7vPxdjF4f5D1mVV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1516	2516	WerFault.exe	8

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 1516	2516	3074966297cb98260bc507b7c535ae8c.exe	28
PID 2516 wrote to memory of 1516	2516	3074966297cb98260bc507b7c535ae8c.exe	28
PID 2516 wrote to memory of 1516	2516	3074966297cb98260bc507b7c535ae8c.exe	28
PID 2516 wrote to memory of 1516	2516	3074966297cb98260bc507b7c535ae8c.exe	28

C:\Users\Admin\AppData\Local\Temp\3074966297cb98260bc507b7c535ae8c.exe
"C:\Users\Admin\AppData\Local\Temp\3074966297cb98260bc507b7c535ae8c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 156
  2⤵
  - Program crash
  PID:1516

memory/2516-0-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/2516-1-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download