e76675ab4cc1ccdb423c7964785f214c82eaaf78b92b53eb80bbc8d60556c4bf

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27-01-2024 22:48

Target

7b7ce5cdf5a866bc9d8c57694a6aef64.exe
Size

1.5MB
MD5

7b7ce5cdf5a866bc9d8c57694a6aef64
SHA1

9fd2fe1f77deceec0eaeb406ab73a0fda9c5a93a
SHA256

e76675ab4cc1ccdb423c7964785f214c82eaaf78b92b53eb80bbc8d60556c4bf
SHA512

0f3b61a1aa0e13c63b80475e92e89ecd47beb306b1f5f9be41930fe59bcf4b5c9fa7ddf0e8d81df8ae504d4c814140507ead9c4b103adb2a1c95e2f8f1ace4aa
SSDEEP

24576:+HrhN1c/JyeiJsCiPpP5SCOJcGwUFp/zAN9UetJOB1RTGkIj3RBI:+LrmxyeGsCiPGzSG9A1OlTGkwhS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	2372	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2224	2372	7b7ce5cdf5a866bc9d8c57694a6aef64.exe	28
PID 2372 wrote to memory of 2224	2372	7b7ce5cdf5a866bc9d8c57694a6aef64.exe	28
PID 2372 wrote to memory of 2224	2372	7b7ce5cdf5a866bc9d8c57694a6aef64.exe	28
PID 2372 wrote to memory of 2224	2372	7b7ce5cdf5a866bc9d8c57694a6aef64.exe	28

C:\Users\Admin\AppData\Local\Temp\7b7ce5cdf5a866bc9d8c57694a6aef64.exe
"C:\Users\Admin\AppData\Local\Temp\7b7ce5cdf5a866bc9d8c57694a6aef64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 92
  2⤵
  - Program crash
  PID:2224