d99e72dbec988f4c190f6560bd05af173bad582083b1281e9ee872d1cf20530c

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 21:34

Target

7592fd56dea00d6c64fe93f3763eb931.exe
Size

739KB
MD5

7592fd56dea00d6c64fe93f3763eb931
SHA1

564e9b07b9c6baed9009e7c2b0ffe93e8da85a71
SHA256

d99e72dbec988f4c190f6560bd05af173bad582083b1281e9ee872d1cf20530c
SHA512

a5455c53f069763d4cfa9f06b0c274e3e0ce6a23f0c915d9740fd2192484be6a6c18ea78d5bff8153300da02fd91b35aad76e7fdd91693f7c47a6c61cb7439c5
SSDEEP

12288:VklwKlICwlZSy5PQHfD4ooJ9Tc7NdOmGWCmxCYaA6TdFHXC9usjb9BhGXGR0wIvz:elwOqZLxQHf/o/c7g9fdFHXev5BhGPwW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2608	2148	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2608	2148	7592fd56dea00d6c64fe93f3763eb931.exe	28
PID 2148 wrote to memory of 2608	2148	7592fd56dea00d6c64fe93f3763eb931.exe	28
PID 2148 wrote to memory of 2608	2148	7592fd56dea00d6c64fe93f3763eb931.exe	28
PID 2148 wrote to memory of 2608	2148	7592fd56dea00d6c64fe93f3763eb931.exe	28

C:\Users\Admin\AppData\Local\Temp\7592fd56dea00d6c64fe93f3763eb931.exe
"C:\Users\Admin\AppData\Local\Temp\7592fd56dea00d6c64fe93f3763eb931.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 116
  2⤵
  - Program crash
  PID:2608