6485275e60beafcc454e0a5c7b5888552867058746a89d6fdd9c084b0e657c09

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 12:58

Target

7d31a18acc6d458f748be9b0f8cd6f02.exe
Size

17KB
MD5

7d31a18acc6d458f748be9b0f8cd6f02
SHA1

5a7fd64c454291d87780a41450a53cbd1e49b58e
SHA256

6485275e60beafcc454e0a5c7b5888552867058746a89d6fdd9c084b0e657c09
SHA512

e03101cdac299dc5b8639ea0b1830c2e4d01fd6472017f83d2a46da2f640d9a20bb32db286380e7351562a88f165b4ca44e8ff1027f7b1c04b1bb1ad6d5bc069
SSDEEP

384:X27E5ugsT/FHTB3rgD/qElQCvD0EnTeSBoT6CC24gsqZ2KFuW8X:hugArgZQCvg6RrPtgsq0+u9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2872	2996	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2872	2996	7d31a18acc6d458f748be9b0f8cd6f02.exe	28
PID 2996 wrote to memory of 2872	2996	7d31a18acc6d458f748be9b0f8cd6f02.exe	28
PID 2996 wrote to memory of 2872	2996	7d31a18acc6d458f748be9b0f8cd6f02.exe	28
PID 2996 wrote to memory of 2872	2996	7d31a18acc6d458f748be9b0f8cd6f02.exe	28

C:\Users\Admin\AppData\Local\Temp\7d31a18acc6d458f748be9b0f8cd6f02.exe
"C:\Users\Admin\AppData\Local\Temp\7d31a18acc6d458f748be9b0f8cd6f02.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 84
  2⤵
  - Program crash
  PID:2872

memory/2996-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download