eb6650053f531d18c782cfd5c7c1b7c0780e043f9fcd0904a15b3efe0aed4f63

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23/01/2024, 20:55

Target

708a5fde57e05e19c08aedd23bf956c8.exe
Size

180KB
MD5

708a5fde57e05e19c08aedd23bf956c8
SHA1

e1ac940c43c3d48d5d2346152dd61551cecbc154
SHA256

eb6650053f531d18c782cfd5c7c1b7c0780e043f9fcd0904a15b3efe0aed4f63
SHA512

fbde4480ed611a3096ce3039ab3e45ec8916a63a38bf8d5fd10a96180d7142f9514770c128011f02b57b6dbd2b37a2f392b341df890490550cb331e0d9419fd9
SSDEEP

3072:t9pNuwe3+Xe/sjDuD+H3lQxy6js/PfoDPz4kQR6CQ5BHnMncAxipMX3u8xzt3i:js3+Xak43xggLVxCqqcAxi4u8xli

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3016	1784	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 3016	1784	708a5fde57e05e19c08aedd23bf956c8.exe	28
PID 1784 wrote to memory of 3016	1784	708a5fde57e05e19c08aedd23bf956c8.exe	28
PID 1784 wrote to memory of 3016	1784	708a5fde57e05e19c08aedd23bf956c8.exe	28
PID 1784 wrote to memory of 3016	1784	708a5fde57e05e19c08aedd23bf956c8.exe	28

C:\Users\Admin\AppData\Local\Temp\708a5fde57e05e19c08aedd23bf956c8.exe
"C:\Users\Admin\AppData\Local\Temp\708a5fde57e05e19c08aedd23bf956c8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 148
  2⤵
  - Program crash
  PID:3016

memory/1784-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download