a3f99074f5d026d6eda2f0990abeeb03dfb45bbd056741208d6d28921bda1e75

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 04:21

Target

716fdb486efb730a987bc2f27f4738dc.exe
Size

24KB
MD5

716fdb486efb730a987bc2f27f4738dc
SHA1

07d033199ff5dcd6829b1d04c13044d9678af847
SHA256

a3f99074f5d026d6eda2f0990abeeb03dfb45bbd056741208d6d28921bda1e75
SHA512

ea1aee49c8dc1f314a103927f700d31cf0f93673be43131369da152b7081f40e2c39a101448ebe95420adea734a73cb5649f4c4e0f24e1c5e5f420019e3dd4f1
SSDEEP

384:gpCZfF5k78ls5dg68oDVcaPg1VuHU198Z9L/EskW86ztKSEZBcx9F3QyziCS:gEZjk7T5O68ofPuVy0m5MskW84tKSEAo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1920	1616	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1920	1616	716fdb486efb730a987bc2f27f4738dc.exe	28
PID 1616 wrote to memory of 1920	1616	716fdb486efb730a987bc2f27f4738dc.exe	28
PID 1616 wrote to memory of 1920	1616	716fdb486efb730a987bc2f27f4738dc.exe	28
PID 1616 wrote to memory of 1920	1616	716fdb486efb730a987bc2f27f4738dc.exe	28

C:\Users\Admin\AppData\Local\Temp\716fdb486efb730a987bc2f27f4738dc.exe
"C:\Users\Admin\AppData\Local\Temp\716fdb486efb730a987bc2f27f4738dc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 36
  2⤵
  - Program crash
  PID:1920

memory/1616-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download