aabc1efda031406b063a954c304d8d18cfcdedcdcc4c3d4d4bdcaa44ed81c8dd

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 09:31

Target

7cc572e03a9d95183760f65a9be257cf.exe
Size

107KB
MD5

7cc572e03a9d95183760f65a9be257cf
SHA1

e813ce794907acf9158f89607bcdb05fbeb1b10e
SHA256

aabc1efda031406b063a954c304d8d18cfcdedcdcc4c3d4d4bdcaa44ed81c8dd
SHA512

c4ff5d6fe2bb223224f978fbfc36c4d515ac8ee1553125dfeec126062c015ce6f800362d4a31f929874d7c2ca2f8baeda78f8e14ff42bddb52ba219cae595576
SSDEEP

1536:1OJ8F+OGefo+JjbOdvcRAOPH1khVo5E+Dc87XEb89JWZaFNoh4AsWt5Jm7Hpqy3e:oJm+OGY5bIv0H1ieQ87UwomAZNy3KV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2952	2948	WerFault.exe	12

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2952	2948	7cc572e03a9d95183760f65a9be257cf.exe	22
PID 2948 wrote to memory of 2952	2948	7cc572e03a9d95183760f65a9be257cf.exe	22
PID 2948 wrote to memory of 2952	2948	7cc572e03a9d95183760f65a9be257cf.exe	22
PID 2948 wrote to memory of 2952	2948	7cc572e03a9d95183760f65a9be257cf.exe	22

C:\Users\Admin\AppData\Local\Temp\7cc572e03a9d95183760f65a9be257cf.exe
"C:\Users\Admin\AppData\Local\Temp\7cc572e03a9d95183760f65a9be257cf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 36
  2⤵
  - Program crash
  PID:2952

memory/2948-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download