7dee43aa5c4f92ac370426f0c6d33f0196d5cf9bb75561a5415ce1d4a81eac2d

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 16:18

Target

7c1c039af4d062438fed57e75ec48895.exe
Size

30KB
MD5

7c1c039af4d062438fed57e75ec48895
SHA1

9bb64902c84c8ba10ad1364c211fba31e722d69e
SHA256

7dee43aa5c4f92ac370426f0c6d33f0196d5cf9bb75561a5415ce1d4a81eac2d
SHA512

6f5545945d4517d58a3ab4981e1250f39477064e7bfb5e7971f3047131fe9deb93218ccbec964fc05df594eeb4b38664be7d3c8b642d19c5fbd1a0ce713b9995
SSDEEP

384:KJZMWceEtSTK2zNRZJhjJwKwV1NbYfX6mOlsHdh5WcvnHR:gMWZnKQtpwKwZbct9n5We

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1760	2664	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 1760	2664	7c1c039af4d062438fed57e75ec48895.exe	28
PID 2664 wrote to memory of 1760	2664	7c1c039af4d062438fed57e75ec48895.exe	28
PID 2664 wrote to memory of 1760	2664	7c1c039af4d062438fed57e75ec48895.exe	28
PID 2664 wrote to memory of 1760	2664	7c1c039af4d062438fed57e75ec48895.exe	28

C:\Users\Admin\AppData\Local\Temp\7c1c039af4d062438fed57e75ec48895.exe
"C:\Users\Admin\AppData\Local\Temp\7c1c039af4d062438fed57e75ec48895.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 92
  2⤵
  - Program crash
  PID:1760