07f16c401cc819d1b546e14327ede9ae91434611e590811f35297d7a443ce682

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23/01/2024, 18:15

Target

703bbe5d3d6337cea053b5a8b4e3d68c.exe
Size

9KB
MD5

703bbe5d3d6337cea053b5a8b4e3d68c
SHA1

c992080ced5c308f112496bf08d9f732d2ca1fec
SHA256

07f16c401cc819d1b546e14327ede9ae91434611e590811f35297d7a443ce682
SHA512

0d56661ed551a160eb63816b69f2981a7791f1a16e612636c8d76b73767bb4144de8bbddf0b9f0a522e0e05d3ba97e770e4f25f25db425e9936b5680cdeceb24
SSDEEP

192:lAmNtPtK/Pfg2Krzkpwo0ZnLCHt/Kz9f8LqjNHl6KjGo8U2Q:5LVUgTzkOZnLClKz9fXNHlMY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2996	2912	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2996	2912	703bbe5d3d6337cea053b5a8b4e3d68c.exe	28
PID 2912 wrote to memory of 2996	2912	703bbe5d3d6337cea053b5a8b4e3d68c.exe	28
PID 2912 wrote to memory of 2996	2912	703bbe5d3d6337cea053b5a8b4e3d68c.exe	28
PID 2912 wrote to memory of 2996	2912	703bbe5d3d6337cea053b5a8b4e3d68c.exe	28

C:\Users\Admin\AppData\Local\Temp\703bbe5d3d6337cea053b5a8b4e3d68c.exe
"C:\Users\Admin\AppData\Local\Temp\703bbe5d3d6337cea053b5a8b4e3d68c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 36
  2⤵
  - Program crash
  PID:2996