e68bbcd2c08b6b3ec60f0f37d7afebdb977a73051aae75164bb8ecbcbe6ac439

Analysis

max time kernel
140s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 16:49

Target

7ac40ee010daa5872eca13ed88106cb8.exe
Size

725KB
MD5

7ac40ee010daa5872eca13ed88106cb8
SHA1

5ef8aedcb61efcf1c35919996bb037ea15b4b0ae
SHA256

e68bbcd2c08b6b3ec60f0f37d7afebdb977a73051aae75164bb8ecbcbe6ac439
SHA512

603a13206ace250272ed9962b0bfcfc8ca214e7db50ea35c15ecc7838d18062f4e8c921232a4617e8e1294abe0c9c36f32de84615d772d76a55170a3f58567ad
SSDEEP

12288:DOJiffspnNEdKJMxNuR+98eXDex6dkMVwof+qePtpi+uVlblOL:Jff6CdK4kyHSxOfFePTsV+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2508	3032	WerFault.exe	6

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2508	3032	7ac40ee010daa5872eca13ed88106cb8.exe	28
PID 3032 wrote to memory of 2508	3032	7ac40ee010daa5872eca13ed88106cb8.exe	28
PID 3032 wrote to memory of 2508	3032	7ac40ee010daa5872eca13ed88106cb8.exe	28
PID 3032 wrote to memory of 2508	3032	7ac40ee010daa5872eca13ed88106cb8.exe	28
PID 3032 wrote to memory of 2508	3032	7ac40ee010daa5872eca13ed88106cb8.exe	28
PID 3032 wrote to memory of 2508	3032	7ac40ee010daa5872eca13ed88106cb8.exe	28
PID 3032 wrote to memory of 2508	3032	7ac40ee010daa5872eca13ed88106cb8.exe	28

C:\Users\Admin\AppData\Local\Temp\7ac40ee010daa5872eca13ed88106cb8.exe
"C:\Users\Admin\AppData\Local\Temp\7ac40ee010daa5872eca13ed88106cb8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 264
  2⤵
  - Program crash
  PID:2508

memory/3032-1-0x0000000000930000-0x00000000009F5000-memory.dmp

Filesize
788KB

Download
memory/3032-0-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/3032-2-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download