eda495a24b82e5e8277c20f8a3906b08ceff334217ea20b774a4b66ee7dc066a

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 00:55

Target

7103c278907a01d043f89a913c1abfbb.exe
Size

55KB
MD5

7103c278907a01d043f89a913c1abfbb
SHA1

3f836911510adb1bf6bd03dc091b206ec671b326
SHA256

eda495a24b82e5e8277c20f8a3906b08ceff334217ea20b774a4b66ee7dc066a
SHA512

5fcf0dd05d2acb4a5f8d3761e06a3cc6a6451fc222a7c3d0a63498d8bd8afa6b760cdc984bac14f48efa8d9d503f7750463982ead8bc07e7ac356944a2c70e06
SSDEEP

1536:yd3L3PJCijehzIqFj6dn3vov1CLnE0FmvI9yV2wrV28v6:uj4zIqF+n/oArE00I3sV7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1312	1700	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1312	1700	7103c278907a01d043f89a913c1abfbb.exe	28
PID 1700 wrote to memory of 1312	1700	7103c278907a01d043f89a913c1abfbb.exe	28
PID 1700 wrote to memory of 1312	1700	7103c278907a01d043f89a913c1abfbb.exe	28
PID 1700 wrote to memory of 1312	1700	7103c278907a01d043f89a913c1abfbb.exe	28

C:\Users\Admin\AppData\Local\Temp\7103c278907a01d043f89a913c1abfbb.exe
"C:\Users\Admin\AppData\Local\Temp\7103c278907a01d043f89a913c1abfbb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 36
  2⤵
  - Program crash
  PID:1312

memory/1700-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1700-1-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1700-2-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download