2d8d625ec29347102f9f4b0144c917b1b9160301480429bb3609ad234a1deb76

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-01-2024 04:32

Target

7ee517971060418a5b8c864d84788689.exe
Size

488KB
MD5

7ee517971060418a5b8c864d84788689
SHA1

5b5081847e7ff0b3f84a10fe62a74baab67ab92e
SHA256

2d8d625ec29347102f9f4b0144c917b1b9160301480429bb3609ad234a1deb76
SHA512

9dc15e433fbd499afcce9f4c0ec69efeed2e01c1b43e9b999ee06e74596b21d76e2241bb73cd2fabea0e1675402a2db307269e0dd84a4c51b799e46425f361ac
SSDEEP

12288:IvOos7XPOkGFQ/ujd+GMv9OaVsU86EM4ShhIAJ:IvOZ7nGm/Yd+GM1aL6EM3htJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2916	2324	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2916	2324	7ee517971060418a5b8c864d84788689.exe	28
PID 2324 wrote to memory of 2916	2324	7ee517971060418a5b8c864d84788689.exe	28
PID 2324 wrote to memory of 2916	2324	7ee517971060418a5b8c864d84788689.exe	28
PID 2324 wrote to memory of 2916	2324	7ee517971060418a5b8c864d84788689.exe	28

C:\Users\Admin\AppData\Local\Temp\7ee517971060418a5b8c864d84788689.exe
"C:\Users\Admin\AppData\Local\Temp\7ee517971060418a5b8c864d84788689.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 116
  2⤵
  - Program crash
  PID:2916

memory/2324-0-0x0000000000E40000-0x0000000000EBE000-memory.dmp

Filesize
504KB

Download