2218c87136f8300dc3f847810ba65ad725ac560b131703fe36f21fbda5176b6f

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 12:17

Target

7d1a8f4eb1b92e7ba878defe4b8ee2c8.exe
Size

364KB
MD5

7d1a8f4eb1b92e7ba878defe4b8ee2c8
SHA1

014fe5fb718d5d0b496c1db7940312b0b32a2c40
SHA256

2218c87136f8300dc3f847810ba65ad725ac560b131703fe36f21fbda5176b6f
SHA512

0d4c2493baeaa23985c996d5c672de9095f51e9b85ef92be35881f88058b7e044d69c6b4df7870d4ae9daf38f31fdddcee310c5376c141f48b95f9757ba48618
SSDEEP

6144:rpEcAd/Mm5ZkyUneRTnJOmQ4W4/6zA5K0TzJRCp4xRvKUllD/W13+f:rTAOm5eyUnJmCzAXTzJR3RvK6lCwf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2716	2804	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2716	2804	7d1a8f4eb1b92e7ba878defe4b8ee2c8.exe	28
PID 2804 wrote to memory of 2716	2804	7d1a8f4eb1b92e7ba878defe4b8ee2c8.exe	28
PID 2804 wrote to memory of 2716	2804	7d1a8f4eb1b92e7ba878defe4b8ee2c8.exe	28
PID 2804 wrote to memory of 2716	2804	7d1a8f4eb1b92e7ba878defe4b8ee2c8.exe	28

C:\Users\Admin\AppData\Local\Temp\7d1a8f4eb1b92e7ba878defe4b8ee2c8.exe
"C:\Users\Admin\AppData\Local\Temp\7d1a8f4eb1b92e7ba878defe4b8ee2c8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 116
  2⤵
  - Program crash
  PID:2716

memory/2804-0-0x0000000000280000-0x00000000002E0000-memory.dmp

Filesize
384KB

Download