35013f9e02b4da48a86efaea5426d8365cbe13cd5b71b66f6af0063b3b68a7c7

Analysis

max time kernel
121s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 16:50

Target

7e00dac7c99641cefa0cc734f0d3a16e.exe
Size

367KB
MD5

7e00dac7c99641cefa0cc734f0d3a16e
SHA1

6e50794d58073eb41b61cece754f97533d72f009
SHA256

35013f9e02b4da48a86efaea5426d8365cbe13cd5b71b66f6af0063b3b68a7c7
SHA512

ed1d1c2aa841243a7324cd8ed2d46b97de078c3de1c78c89721ab7e928318423c193f07500c4aba73e68f5c5c7a2e79008bf95c3b1d6171139198047cc722421
SSDEEP

6144:rpEcAd/Mm5ZkyUneRTnJOmQ4W4/6zA5K0TzJRCp4xRvKUllD/W13+m:rTAOm5eyUnJmCzAXTzJR3RvK6lCwm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2664	2556	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2664	2556	7e00dac7c99641cefa0cc734f0d3a16e.exe	29
PID 2556 wrote to memory of 2664	2556	7e00dac7c99641cefa0cc734f0d3a16e.exe	29
PID 2556 wrote to memory of 2664	2556	7e00dac7c99641cefa0cc734f0d3a16e.exe	29
PID 2556 wrote to memory of 2664	2556	7e00dac7c99641cefa0cc734f0d3a16e.exe	29

C:\Users\Admin\AppData\Local\Temp\7e00dac7c99641cefa0cc734f0d3a16e.exe
"C:\Users\Admin\AppData\Local\Temp\7e00dac7c99641cefa0cc734f0d3a16e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 116
  2⤵
  - Program crash
  PID:2664

memory/2556-0-0x0000000000160000-0x00000000001C0000-memory.dmp

Filesize
384KB

Download