3d7c01543320af780c04451bd8a77d124de5f83370962032970e90e2d3c117a3

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 20:02

Target

3d7c01543320af780c04451bd8a77d124de5f83370962032970e90e2d3c117a3.exe
Size

5KB
MD5

7dfafb77740c3d96c5476a629796023c
SHA1

c9817a7352fbd72b72c0e1680d86af6701ecbbc1
SHA256

3d7c01543320af780c04451bd8a77d124de5f83370962032970e90e2d3c117a3
SHA512

b99da5d44506d9c15e154afee8a7557bfa74fd406cbaf81de6d5bc9ee799f0c5b46956a9dbd6a5a8558fdc33de855a91a62d8ae92302d7a65c3c327727d3dd2b
SSDEEP

48:S/lXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7tgRuqSxp:MWLkFfNnOKYloIQ2pm2pbYScxE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
3032	2672	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 3032	2672	3d7c01543320af780c04451bd8a77d124de5f83370962032970e90e2d3c117a3.exe	14
PID 2672 wrote to memory of 3032	2672	3d7c01543320af780c04451bd8a77d124de5f83370962032970e90e2d3c117a3.exe	14
PID 2672 wrote to memory of 3032	2672	3d7c01543320af780c04451bd8a77d124de5f83370962032970e90e2d3c117a3.exe	14
PID 2672 wrote to memory of 3032	2672	3d7c01543320af780c04451bd8a77d124de5f83370962032970e90e2d3c117a3.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 48
1⤵
- Program crash
PID:3032

C:\Users\Admin\AppData\Local\Temp\3d7c01543320af780c04451bd8a77d124de5f83370962032970e90e2d3c117a3.exe
"C:\Users\Admin\AppData\Local\Temp\3d7c01543320af780c04451bd8a77d124de5f83370962032970e90e2d3c117a3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672