0336e96879f2c2d50332ba41332fa0918e70669e6331d0216ae42251e97b251b

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27-01-2024 03:29

Target

7929ed7748990785a3f206574ddd381a.exe
Size

123KB
MD5

7929ed7748990785a3f206574ddd381a
SHA1

1b1e1c035e395eb5ea8f84afd69bd2c83fc50582
SHA256

0336e96879f2c2d50332ba41332fa0918e70669e6331d0216ae42251e97b251b
SHA512

210363e79274bf0c30ee03d67eec4823cba85f3489ea3105207db30370dc67a66a9d924f9a1cddfe96f04c9c779592641db3cfd042f32fdda28f3a9e9dc1f6b4
SSDEEP

1536:u+LSz/CLPOAXxvd8cg9GLm+XcUUR4dBjeegZP+lfNrPC27YGX89n6kTK/mXmiUD5:jL6/K2AhXiYZY12fxPVMGXAimXNy5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2308	2956	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2308	2956	7929ed7748990785a3f206574ddd381a.exe	28
PID 2956 wrote to memory of 2308	2956	7929ed7748990785a3f206574ddd381a.exe	28
PID 2956 wrote to memory of 2308	2956	7929ed7748990785a3f206574ddd381a.exe	28
PID 2956 wrote to memory of 2308	2956	7929ed7748990785a3f206574ddd381a.exe	28

C:\Users\Admin\AppData\Local\Temp\7929ed7748990785a3f206574ddd381a.exe
"C:\Users\Admin\AppData\Local\Temp\7929ed7748990785a3f206574ddd381a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 36
  2⤵
  - Program crash
  PID:2308

memory/2956-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2956-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download