b9457fdc6487548ba1560f034ae107afc80150ae45dff011e50d83c08cf9e091

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-01-2024 03:58

Target

765301e50e777ec7703925636eb07fa4.exe
Size

372KB
MD5

765301e50e777ec7703925636eb07fa4
SHA1

7ff508db00ac8d440c9f991b93660c1350de61c6
SHA256

b9457fdc6487548ba1560f034ae107afc80150ae45dff011e50d83c08cf9e091
SHA512

31ee676fe886fdc381890e860ad274c90093e58a6c5296d65101d8da856cbddc9cdb71677676c4f0ffe516fda3b5be5290717e94de93c34ea059bff0bcab6eab
SSDEEP

1536:N5qVQuPgUK1birjVajWuul762KmA01NoNyV9IX+mxzUnfoBorCiOYr/wt+ul76k:iJg9qhajWuuQ2KmDNowWX+CgS8+Qk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	1248	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 1728	1248	765301e50e777ec7703925636eb07fa4.exe	28
PID 1248 wrote to memory of 1728	1248	765301e50e777ec7703925636eb07fa4.exe	28
PID 1248 wrote to memory of 1728	1248	765301e50e777ec7703925636eb07fa4.exe	28
PID 1248 wrote to memory of 1728	1248	765301e50e777ec7703925636eb07fa4.exe	28

C:\Users\Admin\AppData\Local\Temp\765301e50e777ec7703925636eb07fa4.exe
"C:\Users\Admin\AppData\Local\Temp\765301e50e777ec7703925636eb07fa4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 140
  2⤵
  - Program crash
  PID:1728

memory/1248-0-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download