4157d870fff93d996d5bdca43d4c0976daeaaf660970894b8865709576715fee

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 00:03

Target

70e8df6dfe5b1e15a9ea2990ab802903.exe
Size

22KB
MD5

70e8df6dfe5b1e15a9ea2990ab802903
SHA1

451d96d4ae26b54b9770d95e69843c20c920686c
SHA256

4157d870fff93d996d5bdca43d4c0976daeaaf660970894b8865709576715fee
SHA512

1b51a3e635bfa0b84f1738fdfe58954fff56af0214a89c118caa5589dbd2d1662e5b2cd4490cc39fbe4765a93dec3c696f124428222bb0438f1f65e314f69214
SSDEEP

384:vY2vDkMqb/6EB2GQ7QN8egBBxvCxONWToc/NwGpy7XDGScj:g286OmQN+BBxKxONWkQNwG47TGz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2664	808	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 2664	808	70e8df6dfe5b1e15a9ea2990ab802903.exe	28
PID 808 wrote to memory of 2664	808	70e8df6dfe5b1e15a9ea2990ab802903.exe	28
PID 808 wrote to memory of 2664	808	70e8df6dfe5b1e15a9ea2990ab802903.exe	28
PID 808 wrote to memory of 2664	808	70e8df6dfe5b1e15a9ea2990ab802903.exe	28

C:\Users\Admin\AppData\Local\Temp\70e8df6dfe5b1e15a9ea2990ab802903.exe
"C:\Users\Admin\AppData\Local\Temp\70e8df6dfe5b1e15a9ea2990ab802903.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 88
  2⤵
  - Program crash
  PID:2664

memory/808-1-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/808-2-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/808-3-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download