02522669f8d95cee25666676019cca9a84be3311aaae22284b09f376b039b770

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 12:18

Target

7fd16afc084f78e78f3704993b9c8d20.exe
Size

527KB
MD5

7fd16afc084f78e78f3704993b9c8d20
SHA1

4c303754ee586b92ffc6345e1c79c0b667589e71
SHA256

02522669f8d95cee25666676019cca9a84be3311aaae22284b09f376b039b770
SHA512

1c42052a3c6e90c53eea4994cbff53e7154110f0a7a908bd453e337f5ed6cb2ae396596c9ba5ae03eac6f7c265e7afba43bc45f251064f2cc3b4a5873b7a3582
SSDEEP

12288:WzL9NgMuPt/wSRX0eg4zqS59QCwavtReXA8lrM2IqH7CD3DH/kJ2BTlDNPOF82:WQXwSm2/RqlrM2IiCDTH/kJ2BTvPW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1748	1960	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1748	1960	7fd16afc084f78e78f3704993b9c8d20.exe	28
PID 1960 wrote to memory of 1748	1960	7fd16afc084f78e78f3704993b9c8d20.exe	28
PID 1960 wrote to memory of 1748	1960	7fd16afc084f78e78f3704993b9c8d20.exe	28
PID 1960 wrote to memory of 1748	1960	7fd16afc084f78e78f3704993b9c8d20.exe	28

C:\Users\Admin\AppData\Local\Temp\7fd16afc084f78e78f3704993b9c8d20.exe
"C:\Users\Admin\AppData\Local\Temp\7fd16afc084f78e78f3704993b9c8d20.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 168
  2⤵
  - Program crash
  PID:1748

memory/1960-0-0x00000000000E0000-0x0000000000165000-memory.dmp

Filesize
532KB

Download