e7f26dfc68c669f0d00c2e2643c449322d10eabbcf91313afb0440cb3274e00a

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 16:13

Target

7bc87b92276ac93de99699ac019b5124.exe
Size

330KB
MD5

7bc87b92276ac93de99699ac019b5124
SHA1

a9ef792186f89db0060faefbb284d9176df73d2b
SHA256

e7f26dfc68c669f0d00c2e2643c449322d10eabbcf91313afb0440cb3274e00a
SHA512

0b9b9d554d26574ffe39404ca67f97ec98c70397e84810471c864340c5778e0076ea68e136dbab4f3ad9d63b91fdf8b456b7db35e188caae0d7066b118c85409
SSDEEP

6144:8XgdcDI3jcIHr57oYGmyOPWlHMPjJ+VMbLlD20nVC8lmovZDp888888888888W8/:wDDm5EoJ+VMbRhb8ovT888888888888B

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1164	3048	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 1164	3048	7bc87b92276ac93de99699ac019b5124.exe	28
PID 3048 wrote to memory of 1164	3048	7bc87b92276ac93de99699ac019b5124.exe	28
PID 3048 wrote to memory of 1164	3048	7bc87b92276ac93de99699ac019b5124.exe	28
PID 3048 wrote to memory of 1164	3048	7bc87b92276ac93de99699ac019b5124.exe	28

C:\Users\Admin\AppData\Local\Temp\7bc87b92276ac93de99699ac019b5124.exe
"C:\Users\Admin\AppData\Local\Temp\7bc87b92276ac93de99699ac019b5124.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 136
  2⤵
  - Program crash
  PID:1164

memory/3048-0-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/3048-1-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download