d77e6bdea83fff015a84a651b3c0a67de4f5a9c2ca4ce8d1259269846ce5764b

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 07:36

Target

864f385a41f3e24a647bb0d10094d09e.exe
Size

23KB
MD5

864f385a41f3e24a647bb0d10094d09e
SHA1

74bc76b4ca7b1d080f853d346498681615e54aaa
SHA256

d77e6bdea83fff015a84a651b3c0a67de4f5a9c2ca4ce8d1259269846ce5764b
SHA512

070b7ea404fe4f11e96ebba1494507a91692801523b054760910b7ce947663cfe92b9623d153776b550e4104342de9157226c37aa50b567e3e594ae08458a3b8
SSDEEP

384:1nt9uqAFnspem17T+Vx/ylBCVx/ylB6sf1ANbyNtOrf1ci5Er7bLNs7s/cBv/Ikj:1nyrsvUjcBCjcB6sisgfzE7LNscUv/I+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2676	2992	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2676	2992	864f385a41f3e24a647bb0d10094d09e.exe	28
PID 2992 wrote to memory of 2676	2992	864f385a41f3e24a647bb0d10094d09e.exe	28
PID 2992 wrote to memory of 2676	2992	864f385a41f3e24a647bb0d10094d09e.exe	28
PID 2992 wrote to memory of 2676	2992	864f385a41f3e24a647bb0d10094d09e.exe	28

C:\Users\Admin\AppData\Local\Temp\864f385a41f3e24a647bb0d10094d09e.exe
"C:\Users\Admin\AppData\Local\Temp\864f385a41f3e24a647bb0d10094d09e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 36
  2⤵
  - Program crash
  PID:2676