29b1f94f4310593890ae5dfbf5abefebc80bfe4072a61a10b18d26020dd864b1

Analysis

max time kernel
118s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 15:57

Target

7acbaa7e59d38307780ff0b0d0cade88.exe
Size

83KB
MD5

7acbaa7e59d38307780ff0b0d0cade88
SHA1

107d23f2a0b44663c101d27754141e75d47e2a50
SHA256

29b1f94f4310593890ae5dfbf5abefebc80bfe4072a61a10b18d26020dd864b1
SHA512

d673c1ece06bdddcd9a20771a29b0709c0a5cce360057cf03de3dd25c75d1afc643063f7b891b3149081b0032c16db50303b5b1b30ced7506ba33a1b4cd5edcb
SSDEEP

1536:dViDALW8j0KuYJJPhpEPVD7vrhsEsepjVrs2ryrd1vUQuqwcizSkX:dVJLW8jxucJPEPVlXtHs2quciu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2356	2944	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2356	2944	7acbaa7e59d38307780ff0b0d0cade88.exe	29
PID 2944 wrote to memory of 2356	2944	7acbaa7e59d38307780ff0b0d0cade88.exe	29
PID 2944 wrote to memory of 2356	2944	7acbaa7e59d38307780ff0b0d0cade88.exe	29
PID 2944 wrote to memory of 2356	2944	7acbaa7e59d38307780ff0b0d0cade88.exe	29

C:\Users\Admin\AppData\Local\Temp\7acbaa7e59d38307780ff0b0d0cade88.exe
"C:\Users\Admin\AppData\Local\Temp\7acbaa7e59d38307780ff0b0d0cade88.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 36
  2⤵
  - Program crash
  PID:2356

memory/2944-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download