47cd5e7c22a80fb0badfc7d315cb4fa23befcd578fd9bee2052bcbc9ede96df1

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 10:18

Target

79fa367922571bff2baff88b36f2c1c0.exe
Size

40KB
MD5

79fa367922571bff2baff88b36f2c1c0
SHA1

7c72396ada6c4ea7ac267e218b7b7004a092494d
SHA256

47cd5e7c22a80fb0badfc7d315cb4fa23befcd578fd9bee2052bcbc9ede96df1
SHA512

a5e39e7c0391fd6e04a679728bf87baa545c5805e19645b4022b703c83a6703a37b6f9bdc09f0aded080d1d26dd5e04c08578e2b426123767524421c56dd05b7
SSDEEP

768:mY2xuwxCJF4w+8SHrQa+uOHA8abeuqWYmnJ+IWWYG8kACr0BCFK6nwUA79T0Fn:mY2xuwq1+8SN+nHrSeuDJ+j8uThxI9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1736	2384	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 1736	2384	79fa367922571bff2baff88b36f2c1c0.exe	28
PID 2384 wrote to memory of 1736	2384	79fa367922571bff2baff88b36f2c1c0.exe	28
PID 2384 wrote to memory of 1736	2384	79fa367922571bff2baff88b36f2c1c0.exe	28
PID 2384 wrote to memory of 1736	2384	79fa367922571bff2baff88b36f2c1c0.exe	28

C:\Users\Admin\AppData\Local\Temp\79fa367922571bff2baff88b36f2c1c0.exe
"C:\Users\Admin\AppData\Local\Temp\79fa367922571bff2baff88b36f2c1c0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 116
  2⤵
  - Program crash
  PID:1736

memory/2384-0-0x0000000000400000-0x0000000000422200-memory.dmp

Filesize
136KB

Download
memory/2384-1-0x0000000000400000-0x0000000000422200-memory.dmp

Filesize
136KB

Download