77ff15a31f0f79655d5e4367d07448796134b9fa492a00cd58c79ba8f68e4b99

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-02-2024 05:12

Target

8605b1a6c9d9c83788a53692367d6dc0.exe
Size

13KB
MD5

8605b1a6c9d9c83788a53692367d6dc0
SHA1

3dae64020a6e34fea11f373334d1bd43ea5541ff
SHA256

77ff15a31f0f79655d5e4367d07448796134b9fa492a00cd58c79ba8f68e4b99
SHA512

85c249dad3892d7dc921886ab2eb731a71f2b1504b31b867762daa1f24570133eb00b77479981b42211f45e084fda08a666adf86f406ed42835fbb705640ecf3
SSDEEP

192:S+ddv4Bymot8FFgHFdfU/GTjIcLE6qHCEUH9WA6WpLUd4RtpIUP:S+dyx/gHXfU/oIcAHodWA6WOd4R

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2504	1708	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2504	1708	8605b1a6c9d9c83788a53692367d6dc0.exe	28
PID 1708 wrote to memory of 2504	1708	8605b1a6c9d9c83788a53692367d6dc0.exe	28
PID 1708 wrote to memory of 2504	1708	8605b1a6c9d9c83788a53692367d6dc0.exe	28
PID 1708 wrote to memory of 2504	1708	8605b1a6c9d9c83788a53692367d6dc0.exe	28

C:\Users\Admin\AppData\Local\Temp\8605b1a6c9d9c83788a53692367d6dc0.exe
"C:\Users\Admin\AppData\Local\Temp\8605b1a6c9d9c83788a53692367d6dc0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 36
  2⤵
  - Program crash
  PID:2504