e7dd013f31fcb4da1beb0241d01358eca42c6eaac5ddb946523b66f84fcdc534

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 07:29

Target

79a286c7e05bbcdff6e99b5e52509a93.exe
Size

1.5MB
MD5

79a286c7e05bbcdff6e99b5e52509a93
SHA1

07e76b1a105ad3f6a333ca19fa1a4a37cd5f192a
SHA256

e7dd013f31fcb4da1beb0241d01358eca42c6eaac5ddb946523b66f84fcdc534
SHA512

9de709efc7222c17d48fd3aef3299841b3173618df8ca16f613cf7f86fd2c7a690ddd73faf4240f54f8a9d87acd18c952518bc104c30c2387a6e46b303b5f042
SSDEEP

24576:o6UBf6InhsADzqEzuBVqiqLRUV43ePVWas25toX6wmFfLY/oybx5Nmn:onX1u1xP7JFhFfLY/DbQn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1748	1684	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1748	1684	79a286c7e05bbcdff6e99b5e52509a93.exe	28
PID 1684 wrote to memory of 1748	1684	79a286c7e05bbcdff6e99b5e52509a93.exe	28
PID 1684 wrote to memory of 1748	1684	79a286c7e05bbcdff6e99b5e52509a93.exe	28
PID 1684 wrote to memory of 1748	1684	79a286c7e05bbcdff6e99b5e52509a93.exe	28

C:\Users\Admin\AppData\Local\Temp\79a286c7e05bbcdff6e99b5e52509a93.exe
"C:\Users\Admin\AppData\Local\Temp\79a286c7e05bbcdff6e99b5e52509a93.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 88
  2⤵
  - Program crash
  PID:1748

memory/1684-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download