f793d4241f923935eb1df8f81a7ae31ea83996feb072730f103c6f4087cd68a9

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 05:44

Target

796cf24c72187af61093cad14f93614a.exe
Size

122KB
MD5

796cf24c72187af61093cad14f93614a
SHA1

97b6176218d5939425b09d69ab9e3b3e12c4ea07
SHA256

f793d4241f923935eb1df8f81a7ae31ea83996feb072730f103c6f4087cd68a9
SHA512

fd205818fa27a2961b325dbc7812725134b5e711b8295898ce0d1e16585b87b86d476e69877c441ddc7ae4caebf9f14da70504b415fb95eb76c6ed35ebd5e866
SSDEEP

3072:Wx2X2GUUA5isDcZF2jHYkd92mz2SaWIOarXW/kkZIlIxUV:c2X2GUUPsE2bYkDLF1FaCMkWlvV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1068	2220	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1068	2220	796cf24c72187af61093cad14f93614a.exe	28
PID 2220 wrote to memory of 1068	2220	796cf24c72187af61093cad14f93614a.exe	28
PID 2220 wrote to memory of 1068	2220	796cf24c72187af61093cad14f93614a.exe	28
PID 2220 wrote to memory of 1068	2220	796cf24c72187af61093cad14f93614a.exe	28

C:\Users\Admin\AppData\Local\Temp\796cf24c72187af61093cad14f93614a.exe
"C:\Users\Admin\AppData\Local\Temp\796cf24c72187af61093cad14f93614a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 36
  2⤵
  - Program crash
  PID:1068

memory/2220-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download