e7bbdedf21f093bb9b08799c164407bd239221be6689e7c1d39620ffd924919d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-01-2024 18:25

Target

704061912e717f63e52fa5fa5dbfa8c5.exe
Size

384KB
MD5

704061912e717f63e52fa5fa5dbfa8c5
SHA1

b527f0340e21566d3494c0a3788385dccf1d0205
SHA256

e7bbdedf21f093bb9b08799c164407bd239221be6689e7c1d39620ffd924919d
SHA512

c2e24c4ffb6c73d6da5c9244557a06c32679ddb199885da59ecdb2483543046252d64d72c27a32c8fa9dab5f9b95c955696d070b0959f313f7a2ec9c9704b6b5
SSDEEP

6144:UiMqbHbEQhY8+/3/pVEbn/cHE/xIU+lVsdXGU/EzTT/F1vD9zeqo:JHbLhY8+/3ETG5zTLPQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2032	2044	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2032	2044	704061912e717f63e52fa5fa5dbfa8c5.exe	28
PID 2044 wrote to memory of 2032	2044	704061912e717f63e52fa5fa5dbfa8c5.exe	28
PID 2044 wrote to memory of 2032	2044	704061912e717f63e52fa5fa5dbfa8c5.exe	28
PID 2044 wrote to memory of 2032	2044	704061912e717f63e52fa5fa5dbfa8c5.exe	28

C:\Users\Admin\AppData\Local\Temp\704061912e717f63e52fa5fa5dbfa8c5.exe
"C:\Users\Admin\AppData\Local\Temp\704061912e717f63e52fa5fa5dbfa8c5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 140
  2⤵
  - Program crash
  PID:2032

memory/2044-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2044-1-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download