353927fe893c1e1997b5819f7acfdc879e0ed60260cf26b9334984eafb298aad

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 14:45

Target

7a85d289dbf80f4119a3e8a3c9a03963.exe
Size

83KB
MD5

7a85d289dbf80f4119a3e8a3c9a03963
SHA1

952b12cc8456a6cca851da374868349b72b0c2dc
SHA256

353927fe893c1e1997b5819f7acfdc879e0ed60260cf26b9334984eafb298aad
SHA512

aa36817ce3441e1ab9eb0051bb91ac9f0301e5e05fe3421ab7d213f1d9102956ca38f46caa5e878cd9f2940b4ab25044df177e25c2a3b8fda628306dae014d32
SSDEEP

1536:nMzx37GrBbJ6ZSO9BvphK0jLIwVRgc+mSKX32Lmm18kpjVrs2ryrd1vUQuqwcizz:MzB+Q9NpY0j/VRgcPSKX36HHs2quciu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1488	1640	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1488	1640	7a85d289dbf80f4119a3e8a3c9a03963.exe	28
PID 1640 wrote to memory of 1488	1640	7a85d289dbf80f4119a3e8a3c9a03963.exe	28
PID 1640 wrote to memory of 1488	1640	7a85d289dbf80f4119a3e8a3c9a03963.exe	28
PID 1640 wrote to memory of 1488	1640	7a85d289dbf80f4119a3e8a3c9a03963.exe	28

C:\Users\Admin\AppData\Local\Temp\7a85d289dbf80f4119a3e8a3c9a03963.exe
"C:\Users\Admin\AppData\Local\Temp\7a85d289dbf80f4119a3e8a3c9a03963.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 36
  2⤵
  - Program crash
  PID:1488

memory/1640-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download