a7f91f950abbc99a502f1cfd961158c5534b509e3b250a0296b3e7623886c8c1

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 01:46

Target

3b94ca9971cbebd7c3f009e28d0a6722.exe
Size

66KB
MD5

3b94ca9971cbebd7c3f009e28d0a6722
SHA1

39313d644c551c08d2d42d1675dfd58388de9eb5
SHA256

a7f91f950abbc99a502f1cfd961158c5534b509e3b250a0296b3e7623886c8c1
SHA512

2e519ed6165df5c479aa6d578d309ad9c3dbd4ab4be2338ce057e6cfd2b351935f6a0858b593d6070e822f6508943c83c7f0e240cbc7caef9ba93b9ebb330637
SSDEEP

1536:qwfRxBetNxMilO6ODBmxWnaWNHlrHKT7upjiEQEzIIYLfYV:lzoPxMuTgB1aWFlW/u5DIIYba

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
1732	2820	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 1732	2820	3b94ca9971cbebd7c3f009e28d0a6722.exe	16
PID 2820 wrote to memory of 1732	2820	3b94ca9971cbebd7c3f009e28d0a6722.exe	16
PID 2820 wrote to memory of 1732	2820	3b94ca9971cbebd7c3f009e28d0a6722.exe	16
PID 2820 wrote to memory of 1732	2820	3b94ca9971cbebd7c3f009e28d0a6722.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 88
1⤵
- Program crash
PID:1732

C:\Users\Admin\AppData\Local\Temp\3b94ca9971cbebd7c3f009e28d0a6722.exe
"C:\Users\Admin\AppData\Local\Temp\3b94ca9971cbebd7c3f009e28d0a6722.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2820

memory/2820-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download