e0dd3cf2fca81c3a4bc30f330cb361de027cac14ad0a08d3e726d9290e95e290

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 23:30

Target

7b91741580b30e714deed8ce2f665e8a.exe
Size

76KB
MD5

7b91741580b30e714deed8ce2f665e8a
SHA1

cf6d5a6b23f6cc6b6d6956b025259bc9937589c6
SHA256

e0dd3cf2fca81c3a4bc30f330cb361de027cac14ad0a08d3e726d9290e95e290
SHA512

872abedc2c42c58ab0782ef6d90f23f37a0913f7ece6a659c1795eea57885c59e17f964672e9b787e9083b8eff4d47bfea595a968b2f80ca036b76a7e45d37ee
SSDEEP

1536:6/ePyXHZ7DA4BfBrmTiXvvvUgbFNCuACP1DIgN:AeSHZ7DTBfBrB/UgbFNCuAq2C

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2544	2792	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2544	2792	7b91741580b30e714deed8ce2f665e8a.exe	16
PID 2792 wrote to memory of 2544	2792	7b91741580b30e714deed8ce2f665e8a.exe	16
PID 2792 wrote to memory of 2544	2792	7b91741580b30e714deed8ce2f665e8a.exe	16
PID 2792 wrote to memory of 2544	2792	7b91741580b30e714deed8ce2f665e8a.exe	16

C:\Users\Admin\AppData\Local\Temp\7b91741580b30e714deed8ce2f665e8a.exe
"C:\Users\Admin\AppData\Local\Temp\7b91741580b30e714deed8ce2f665e8a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 108
  2⤵
  - Program crash
  PID:2544

memory/2792-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2792-1-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download