ca89c533b80fce15369c6e73a275cd445cbc403b75f3f55dc211a3986203d62b

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 12:07

Target

7fcbb38eaa3d6423225c2dd233ff57d6.exe
Size

276KB
MD5

7fcbb38eaa3d6423225c2dd233ff57d6
SHA1

4bf0d8e8ebf1d9f62abae03c9ee333c9b5a37ab0
SHA256

ca89c533b80fce15369c6e73a275cd445cbc403b75f3f55dc211a3986203d62b
SHA512

91925e805f3be48a58e8253db6493c668d9013b7f003f630625e304640bfaf387fd31d7d21591ff357c208161eed5e8dfba4fecdf5b956c06367ac4890061113
SSDEEP

3072:SO0PCQ2nZnSdcsRg0Znyjhlm5OQ7B35dAWFoYIKsQYFkLFWClSm/5+qTuoeel1a2:d0KN6FwKlkClSm/5+IfrSEKygpLd/0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2316	2428	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2316	2428	7fcbb38eaa3d6423225c2dd233ff57d6.exe	28
PID 2428 wrote to memory of 2316	2428	7fcbb38eaa3d6423225c2dd233ff57d6.exe	28
PID 2428 wrote to memory of 2316	2428	7fcbb38eaa3d6423225c2dd233ff57d6.exe	28
PID 2428 wrote to memory of 2316	2428	7fcbb38eaa3d6423225c2dd233ff57d6.exe	28

C:\Users\Admin\AppData\Local\Temp\7fcbb38eaa3d6423225c2dd233ff57d6.exe
"C:\Users\Admin\AppData\Local\Temp\7fcbb38eaa3d6423225c2dd233ff57d6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 164
  2⤵
  - Program crash
  PID:2316