806fea21c62cff1eb88131747b4256df44772be3785b590d4516eed3cf76c776

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 02:01

Target

737174964c9ccc7a609a2c274f06bbb8.exe
Size

367KB
MD5

737174964c9ccc7a609a2c274f06bbb8
SHA1

fa673888bd36a770ecdbbdc267c20e7c06500879
SHA256

806fea21c62cff1eb88131747b4256df44772be3785b590d4516eed3cf76c776
SHA512

86df4c844369dc0311a07988d2b4cff7f1ad3b2d147951962a12990019fb809df94ddb2edd4b4705195c8162971bb12d239717f74cd709f03fa108c8dd16c72b
SSDEEP

6144:rpEcAd/Mm5ZkyUneRTnJOmQ4W4/6zA5K0TzJRCp4xRvKUllD/W13+T:rTAOm5eyUnJmCzAXTzJR3RvK6lCwT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2252	1684	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2252	1684	737174964c9ccc7a609a2c274f06bbb8.exe	28
PID 1684 wrote to memory of 2252	1684	737174964c9ccc7a609a2c274f06bbb8.exe	28
PID 1684 wrote to memory of 2252	1684	737174964c9ccc7a609a2c274f06bbb8.exe	28
PID 1684 wrote to memory of 2252	1684	737174964c9ccc7a609a2c274f06bbb8.exe	28

C:\Users\Admin\AppData\Local\Temp\737174964c9ccc7a609a2c274f06bbb8.exe
"C:\Users\Admin\AppData\Local\Temp\737174964c9ccc7a609a2c274f06bbb8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 116
  2⤵
  - Program crash
  PID:2252

memory/1684-0-0x0000000000160000-0x00000000001C0000-memory.dmp

Filesize
384KB

Download