6f50050559d977fbe5a4768684639cc9895ef75ad9ee58d23223768baac08ddc

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-01-2024 15:26

Target

77b797001503946a1220e2d6aac917c4.exe
Size

76KB
MD5

77b797001503946a1220e2d6aac917c4
SHA1

ca4de1b7dcabe99df0a290c557617f90a49b6992
SHA256

6f50050559d977fbe5a4768684639cc9895ef75ad9ee58d23223768baac08ddc
SHA512

b816bad9ee4378bdd0bb85ba702e68db9bd8a4e90bfb437bb4c62259ef8fe3ee09bbbbdcb12cb93411722bff9c3c0a747b2b825eb26f0a5f3f926976eafc4689
SSDEEP

1536:s5jqSoKhCN/GEo1f/Fa2vaBmxKCE4+rSKz8FPfbpjVrs2ryrd1vUQuq6:2jqSB/EWJvaBmxKj5OxPTHs2qo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1784	2448	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 1784	2448	77b797001503946a1220e2d6aac917c4.exe	28
PID 2448 wrote to memory of 1784	2448	77b797001503946a1220e2d6aac917c4.exe	28
PID 2448 wrote to memory of 1784	2448	77b797001503946a1220e2d6aac917c4.exe	28
PID 2448 wrote to memory of 1784	2448	77b797001503946a1220e2d6aac917c4.exe	28

C:\Users\Admin\AppData\Local\Temp\77b797001503946a1220e2d6aac917c4.exe
"C:\Users\Admin\AppData\Local\Temp\77b797001503946a1220e2d6aac917c4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 36
  2⤵
  - Program crash
  PID:1784

memory/2448-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download