bd5cee840375c669e230992ce792010a8e643a388329ba8f2c744cd7864a52df

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 10:50

Target

7cecdd2d9ecd11b105ae7a07c00c3bba.exe
Size

1.3MB
MD5

7cecdd2d9ecd11b105ae7a07c00c3bba
SHA1

3e91fac046ef04b751757e5f6beb04b78383a3eb
SHA256

bd5cee840375c669e230992ce792010a8e643a388329ba8f2c744cd7864a52df
SHA512

fe80c5616702f383a30e9416d650966ea90dad81683ec899b3d33fe962a1b72fcd0fd70d0c26995dc9c19edb9013423176bcb5d44c338ea54dc471bb10f117ea
SSDEEP

12288:+KmPKcel4LK12wVypaD5tgFn9Z02N3myJH0UWxS1ORGR+fk9JxgZR5b5:+ucelR4wVypajmFBdJHPWxiORGr9qT5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1044	2168	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1044	2168	7cecdd2d9ecd11b105ae7a07c00c3bba.exe	28
PID 2168 wrote to memory of 1044	2168	7cecdd2d9ecd11b105ae7a07c00c3bba.exe	28
PID 2168 wrote to memory of 1044	2168	7cecdd2d9ecd11b105ae7a07c00c3bba.exe	28
PID 2168 wrote to memory of 1044	2168	7cecdd2d9ecd11b105ae7a07c00c3bba.exe	28

C:\Users\Admin\AppData\Local\Temp\7cecdd2d9ecd11b105ae7a07c00c3bba.exe
"C:\Users\Admin\AppData\Local\Temp\7cecdd2d9ecd11b105ae7a07c00c3bba.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 180
  2⤵
  - Program crash
  PID:1044

memory/2168-0-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download