9424fd2d2836598521a802e1a66e741a9396a9d2d42336d99cad57d066653566

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27-01-2024 22:33

Target

7b754d6f8862bbaa6130edcb5c5ac8aa.exe
Size

24KB
MD5

7b754d6f8862bbaa6130edcb5c5ac8aa
SHA1

d7684894136b6f9c29f5c96e6b9f3980136f015b
SHA256

9424fd2d2836598521a802e1a66e741a9396a9d2d42336d99cad57d066653566
SHA512

65ccc4506ab57d39cfd04b7e23b216b7c027a4cd5f1f30687f10794a323c897589c35b15330039583ea0e686b31bb348eff65ba0d855b54db486573972555080
SSDEEP

384:AQUPnisXB4HhpexbGAjFAG1h4VHUB+3hXr9DxTeiaRiaxOcvVIa:ATPnismHhpiXj+G12VHBpVxsiWNV9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2972	2924	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2972	2924	7b754d6f8862bbaa6130edcb5c5ac8aa.exe	28
PID 2924 wrote to memory of 2972	2924	7b754d6f8862bbaa6130edcb5c5ac8aa.exe	28
PID 2924 wrote to memory of 2972	2924	7b754d6f8862bbaa6130edcb5c5ac8aa.exe	28
PID 2924 wrote to memory of 2972	2924	7b754d6f8862bbaa6130edcb5c5ac8aa.exe	28

C:\Users\Admin\AppData\Local\Temp\7b754d6f8862bbaa6130edcb5c5ac8aa.exe
"C:\Users\Admin\AppData\Local\Temp\7b754d6f8862bbaa6130edcb5c5ac8aa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 140
  2⤵
  - Program crash
  PID:2972

memory/2924-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2924-1-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download
memory/2924-2-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download