7a25e2e81eb09d3870799ca205839c30b6dd2c9505d266ac58bdc7dc8bd8d0ab

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 11:54

Target

654def0a2cae0169d6055e7e198cbf31.exe
Size

123KB
MD5

654def0a2cae0169d6055e7e198cbf31
SHA1

1dd83fcbb325ad95231711a43bca1253cbff13c0
SHA256

7a25e2e81eb09d3870799ca205839c30b6dd2c9505d266ac58bdc7dc8bd8d0ab
SHA512

3312a9e68b64b14d285b3b0a18d0cf498b218c4debd9a0d6d19a1040f243bbb2c4629118249e029e2e60572a45aed85cce4a8932a602e3cab8f2c9a4e1193db9
SSDEEP

3072:VE7zSlrbMWNIP1zMCdjDFyeG5JYs9eR4T+ckSCx/5zoO2p:+7W/MuIP1jWJVseaNq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2292	1252	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 2292	1252	654def0a2cae0169d6055e7e198cbf31.exe	28
PID 1252 wrote to memory of 2292	1252	654def0a2cae0169d6055e7e198cbf31.exe	28
PID 1252 wrote to memory of 2292	1252	654def0a2cae0169d6055e7e198cbf31.exe	28
PID 1252 wrote to memory of 2292	1252	654def0a2cae0169d6055e7e198cbf31.exe	28

C:\Users\Admin\AppData\Local\Temp\654def0a2cae0169d6055e7e198cbf31.exe
"C:\Users\Admin\AppData\Local\Temp\654def0a2cae0169d6055e7e198cbf31.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 136
  2⤵
  - Program crash
  PID:2292

memory/1252-0-0x0000000000400000-0x000000000050F000-memory.dmp

Filesize
1.1MB

Download