948eb48eed0ec8260d38cff20d033e694cb97fbfdf36758d00945251b142ba71

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 17:05

Target

7d87b04f35398fe0e68b8a2ef59ab4d1.exe
Size

99KB
MD5

7d87b04f35398fe0e68b8a2ef59ab4d1
SHA1

347bd96cd9e8b083623c40127d0a3cd5d2596639
SHA256

948eb48eed0ec8260d38cff20d033e694cb97fbfdf36758d00945251b142ba71
SHA512

243fb32a75914828c4f0af1c5b66a390208d07fe38e9eb5bfaf2e1f135ba37b2880c792358c94adeca83ec20edb00e5065dd73cf3c895c489ffb5790c927da5f
SSDEEP

1536:OcFGLdJTRiIQfAR6BQA12A+CnoQz6oSSYlWOitCvQf7MwsoYd8dWea8VFUYi781:Oc4LUIH6BjIASxoSSsRQM+BPbR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1020	1936	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1020	1936	7d87b04f35398fe0e68b8a2ef59ab4d1.exe	28
PID 1936 wrote to memory of 1020	1936	7d87b04f35398fe0e68b8a2ef59ab4d1.exe	28
PID 1936 wrote to memory of 1020	1936	7d87b04f35398fe0e68b8a2ef59ab4d1.exe	28
PID 1936 wrote to memory of 1020	1936	7d87b04f35398fe0e68b8a2ef59ab4d1.exe	28

C:\Users\Admin\AppData\Local\Temp\7d87b04f35398fe0e68b8a2ef59ab4d1.exe
"C:\Users\Admin\AppData\Local\Temp\7d87b04f35398fe0e68b8a2ef59ab4d1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 44
  2⤵
  - Program crash
  PID:1020

memory/1936-0-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/1936-1-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download