e6592167256f72cf475367430f84079e72065ec5ebe1aef32efd154a529c29c0

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 03:49

Target

7ecdd1d1fcaf6a4ce7f3e3286426a5dd.exe
Size

190KB
MD5

7ecdd1d1fcaf6a4ce7f3e3286426a5dd
SHA1

c953d5b59d0b069ab41551a4abbb1f74f17a9e48
SHA256

e6592167256f72cf475367430f84079e72065ec5ebe1aef32efd154a529c29c0
SHA512

5e709465ff0e96d44a7491df8e1544f3563637b4901018f99f4cd06558c9cd7c50edda8b796448f504fb2b516d6e3ec11cf393c43b463152cebdf72104ae869f
SSDEEP

3072:qmi6m3UVa+GHOu/0Dpf4NuYmz01cJ4UEDzXEyhR5aIOWoeOp/MSh:jQrHOm09NxicCUE/vhR0R5k

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2364	2932	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2364	2932	7ecdd1d1fcaf6a4ce7f3e3286426a5dd.exe	28
PID 2932 wrote to memory of 2364	2932	7ecdd1d1fcaf6a4ce7f3e3286426a5dd.exe	28
PID 2932 wrote to memory of 2364	2932	7ecdd1d1fcaf6a4ce7f3e3286426a5dd.exe	28
PID 2932 wrote to memory of 2364	2932	7ecdd1d1fcaf6a4ce7f3e3286426a5dd.exe	28

C:\Users\Admin\AppData\Local\Temp\7ecdd1d1fcaf6a4ce7f3e3286426a5dd.exe
"C:\Users\Admin\AppData\Local\Temp\7ecdd1d1fcaf6a4ce7f3e3286426a5dd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 116
  2⤵
  - Program crash
  PID:2364

memory/2932-0-0x0000000000400000-0x00000000004FC000-memory.dmp

Filesize
1008KB

Download
memory/2932-3-0x0000000000400000-0x00000000004FC000-memory.dmp

Filesize
1008KB

Download
memory/2932-1-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2932-4-0x0000000000400000-0x00000000004FC000-memory.dmp

Filesize
1008KB

Download
memory/2932-5-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download