6b729805fa4a1df08a950ba402cb77a461db51d75b95ad4ffe1efdfe2ad12dd7

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 00:26

Target

7341a2f658d056092c49fe564c697549.exe
Size

76KB
MD5

7341a2f658d056092c49fe564c697549
SHA1

756b585f48edfa4354a804aad4a7342c74264a15
SHA256

6b729805fa4a1df08a950ba402cb77a461db51d75b95ad4ffe1efdfe2ad12dd7
SHA512

9133fd792d7cc2a8f461049afac43c9c4fda646d1420b4926c1921a88339f09b12c8d91fad26b708e0a1c861f8ae9570eb3245ac1c072282b2c2a4afd54670d9
SSDEEP

1536:Og0RAkUGP+H/bhjtIMILvx3uc1gKPFavIoK3BqA6+PKtyHjXAXqjEErxTWDTMqhj:hhtIMk3JNPtD6+iEhjBkMqhGKZTbx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2324	1200	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2324	1200	7341a2f658d056092c49fe564c697549.exe	28
PID 1200 wrote to memory of 2324	1200	7341a2f658d056092c49fe564c697549.exe	28
PID 1200 wrote to memory of 2324	1200	7341a2f658d056092c49fe564c697549.exe	28
PID 1200 wrote to memory of 2324	1200	7341a2f658d056092c49fe564c697549.exe	28

C:\Users\Admin\AppData\Local\Temp\7341a2f658d056092c49fe564c697549.exe
"C:\Users\Admin\AppData\Local\Temp\7341a2f658d056092c49fe564c697549.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 36
  2⤵
  - Program crash
  PID:2324

memory/1200-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download