332d97d5c24ebf4df944a6a50787b85405cb960069863ccbf1e94f1802763753

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27-01-2024 22:27

Target

7b7254c3ebfb220d800ae3056a4badf7.exe
Size

3.1MB
MD5

7b7254c3ebfb220d800ae3056a4badf7
SHA1

dc81856d545f8471ab6231e5c85a34932cb5501a
SHA256

332d97d5c24ebf4df944a6a50787b85405cb960069863ccbf1e94f1802763753
SHA512

916ee7a61ccc472f3d006e0e309b0369d607eb8e388da57b7d99a4b097a2b32a86b259ce122a7635e57de0cd93e434ad9b00afc92142d7baf95e3550e21dc55a
SSDEEP

98304:mlljAnIxSZ7lBEJD4pJmDbCMnEufbADRiXCAo:mlljAnwu7DEG/mDddjKRNAo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1972	2192	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1972	2192	7b7254c3ebfb220d800ae3056a4badf7.exe	28
PID 2192 wrote to memory of 1972	2192	7b7254c3ebfb220d800ae3056a4badf7.exe	28
PID 2192 wrote to memory of 1972	2192	7b7254c3ebfb220d800ae3056a4badf7.exe	28
PID 2192 wrote to memory of 1972	2192	7b7254c3ebfb220d800ae3056a4badf7.exe	28

C:\Users\Admin\AppData\Local\Temp\7b7254c3ebfb220d800ae3056a4badf7.exe
"C:\Users\Admin\AppData\Local\Temp\7b7254c3ebfb220d800ae3056a4badf7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 628
  2⤵
  - Program crash
  PID:1972

memory/2192-0-0x0000000000DF0000-0x0000000001110000-memory.dmp

Filesize
3.1MB

Download
memory/2192-1-0x00000000749D0000-0x00000000750BE000-memory.dmp

Filesize
6.9MB

Download
memory/2192-2-0x0000000000590000-0x00000000005D0000-memory.dmp

Filesize
256KB

Download
memory/2192-3-0x00000000749D0000-0x00000000750BE000-memory.dmp

Filesize
6.9MB

Download
memory/2192-4-0x0000000000590000-0x00000000005D0000-memory.dmp

Filesize
256KB

Download