7dfd805736dfaf2cbbac5e1feaba05f4c37e3cf082cdd2b61a9d174370173ead

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 07:20

Target

64ce21d8b89de1e7f3ec9b5e1ddfcfa0.exe
Size

1.0MB
MD5

64ce21d8b89de1e7f3ec9b5e1ddfcfa0
SHA1

43191c433847be502563fbf6d7c615582cd9f24d
SHA256

7dfd805736dfaf2cbbac5e1feaba05f4c37e3cf082cdd2b61a9d174370173ead
SHA512

ddcbc20664253af5c4d6792a87f6e15211d42236c60d2fb57f787f5e4642fa477fdb1f13bc4ba8c7be982801cd581ea4739c679712a979ea9ecb7c7295406ab8
SSDEEP

24576:1zKqVAc11zRSfg9idLfM4IKXx8Hs52OnrTUPmOzSI3l:1/yc11zAwidLfM47XxCsjrwezg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2272	1368	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2272	1368	64ce21d8b89de1e7f3ec9b5e1ddfcfa0.exe	28
PID 1368 wrote to memory of 2272	1368	64ce21d8b89de1e7f3ec9b5e1ddfcfa0.exe	28
PID 1368 wrote to memory of 2272	1368	64ce21d8b89de1e7f3ec9b5e1ddfcfa0.exe	28
PID 1368 wrote to memory of 2272	1368	64ce21d8b89de1e7f3ec9b5e1ddfcfa0.exe	28

C:\Users\Admin\AppData\Local\Temp\64ce21d8b89de1e7f3ec9b5e1ddfcfa0.exe
"C:\Users\Admin\AppData\Local\Temp\64ce21d8b89de1e7f3ec9b5e1ddfcfa0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 88
  2⤵
  - Program crash
  PID:2272

memory/1368-0-0x0000000000400000-0x000000000040E192-memory.dmp

Filesize
56KB

Download
memory/1368-1-0x0000000000400000-0x000000000040E192-memory.dmp

Filesize
56KB

Download