8f4081a84637a95b0e39f6991e42beda81b9c4bd5f18836281925d9f4db5ec69

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 11:58

Target

7d0f8298637f4fa634faf0218bc2cc58.exe
Size

430KB
MD5

7d0f8298637f4fa634faf0218bc2cc58
SHA1

4a98db94ab7396a8d6d4d9054af38ef1b1a71073
SHA256

8f4081a84637a95b0e39f6991e42beda81b9c4bd5f18836281925d9f4db5ec69
SHA512

f56731f1b81ebee6bedd86580483bff6a393f41e2f530e21651eb79f54606c440b6b85538c20ffedacd488e37693e08878df660746f3377a4a3fb56ac21a6e1c
SSDEEP

6144:Ulsy4TNbEm1B1zzqaCh9Ju/2x+vw0b8ajNglS2+gUXpP9YC4r:UdwNIm1B1zzqrh9Jf+btwSfgUnBI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1720	2384	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 1720	2384	7d0f8298637f4fa634faf0218bc2cc58.exe	28
PID 2384 wrote to memory of 1720	2384	7d0f8298637f4fa634faf0218bc2cc58.exe	28
PID 2384 wrote to memory of 1720	2384	7d0f8298637f4fa634faf0218bc2cc58.exe	28
PID 2384 wrote to memory of 1720	2384	7d0f8298637f4fa634faf0218bc2cc58.exe	28

C:\Users\Admin\AppData\Local\Temp\7d0f8298637f4fa634faf0218bc2cc58.exe
"C:\Users\Admin\AppData\Local\Temp\7d0f8298637f4fa634faf0218bc2cc58.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 116
  2⤵
  - Program crash
  PID:1720

memory/2384-0-0x00000000012D0000-0x0000000001340000-memory.dmp

Filesize
448KB

Download