d43795dbc345bbf9d5207d3d76ddae2c05d6ab2858a3ba50c59f413143ae152b

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 02:13

Target

737793f69a1b3498a9c17c966499da52.exe
Size

90KB
MD5

737793f69a1b3498a9c17c966499da52
SHA1

716856f68287d9db84a47f4b082f1c3da08e3ed1
SHA256

d43795dbc345bbf9d5207d3d76ddae2c05d6ab2858a3ba50c59f413143ae152b
SHA512

9a6af94512af68f093ff8ee7851d346bb799ef13f0789fc9a92c6101f2c7d4ca06ea4864992fe661ca2b43ac21137d321f0ce4c3cd617e7bbadab5f4c3f3368b
SSDEEP

1536:ueJ1RQj1zvurXrowFXnd0EfEQTZ2FhKGCqqK/Wnfjfge9lHvKEZ:ueJjQj1zvgxX2EH2FvdqKO91vf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3040	1020	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 3040	1020	737793f69a1b3498a9c17c966499da52.exe	28
PID 1020 wrote to memory of 3040	1020	737793f69a1b3498a9c17c966499da52.exe	28
PID 1020 wrote to memory of 3040	1020	737793f69a1b3498a9c17c966499da52.exe	28
PID 1020 wrote to memory of 3040	1020	737793f69a1b3498a9c17c966499da52.exe	28

C:\Users\Admin\AppData\Local\Temp\737793f69a1b3498a9c17c966499da52.exe
"C:\Users\Admin\AppData\Local\Temp\737793f69a1b3498a9c17c966499da52.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 84
  2⤵
  - Program crash
  PID:3040

memory/1020-0-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download