2da3ec685e274b23b21437b9baf8e266eb6b6ef955b097a8bcddc689252d335c

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-01-2024 16:05

Target

7d66dfca00f5f6076435a3035322fb0b.exe
Size

66KB
MD5

7d66dfca00f5f6076435a3035322fb0b
SHA1

709478d26519fa8bb10761ee5424505f4f8e0e76
SHA256

2da3ec685e274b23b21437b9baf8e266eb6b6ef955b097a8bcddc689252d335c
SHA512

f949cb55d04051382e9d4ad9ea81b0ebf4245d4ad1ff013fd910cd606e8ccec8b3f042c6abf9a1738391913673c78f68d0fdd10125242c4e70c9c5deb3fc17c3
SSDEEP

1536:MBZykeozqcgQTHVzJ4zuZZRVScx5oH70SDdzrelIoqJxxVfBd:MXQoeRQT1l4zsZRVScMH70SDobG1fL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1352	1568	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 1352	1568	7d66dfca00f5f6076435a3035322fb0b.exe	28
PID 1568 wrote to memory of 1352	1568	7d66dfca00f5f6076435a3035322fb0b.exe	28
PID 1568 wrote to memory of 1352	1568	7d66dfca00f5f6076435a3035322fb0b.exe	28
PID 1568 wrote to memory of 1352	1568	7d66dfca00f5f6076435a3035322fb0b.exe	28

C:\Users\Admin\AppData\Local\Temp\7d66dfca00f5f6076435a3035322fb0b.exe
"C:\Users\Admin\AppData\Local\Temp\7d66dfca00f5f6076435a3035322fb0b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 36
  2⤵
  - Program crash
  PID:1352

memory/1568-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download