175a328ebf808bcc29c7e579a82b6cf6384c23334c79d276cb16dd74214ab98e

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 06:52

Target

798fdeb2d7f18c3cf6481c55c3822cb4.exe
Size

430KB
MD5

798fdeb2d7f18c3cf6481c55c3822cb4
SHA1

ca15a596c53670f2a6992dbf3c091369f8c81914
SHA256

175a328ebf808bcc29c7e579a82b6cf6384c23334c79d276cb16dd74214ab98e
SHA512

a987e3d279b9cb75833d236a3ef93af6e334e44971a6f6858a1d7a8cbcde8a366ed1df3130a120082dc4c272fc6ddf429e8e3b7106d46ed6a7d5e7f7b436aef8
SSDEEP

6144:Ulsy4TNbEm1B1zzqaCh9Ju/2x+vw0b8ajNglS2+gUXpP9YC4r:UdwNIm1B1zzqrh9Jf+btwSfgUnBI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2392	1676	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2392	1676	798fdeb2d7f18c3cf6481c55c3822cb4.exe	28
PID 1676 wrote to memory of 2392	1676	798fdeb2d7f18c3cf6481c55c3822cb4.exe	28
PID 1676 wrote to memory of 2392	1676	798fdeb2d7f18c3cf6481c55c3822cb4.exe	28
PID 1676 wrote to memory of 2392	1676	798fdeb2d7f18c3cf6481c55c3822cb4.exe	28

C:\Users\Admin\AppData\Local\Temp\798fdeb2d7f18c3cf6481c55c3822cb4.exe
"C:\Users\Admin\AppData\Local\Temp\798fdeb2d7f18c3cf6481c55c3822cb4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 116
  2⤵
  - Program crash
  PID:2392

memory/1676-0-0x0000000001250000-0x00000000012C0000-memory.dmp

Filesize
448KB

Download