fe9ef92c748a292553f5a2b93fae0154750581642ececf5671ea68013ee51066

Analysis

max time kernel
65s
max time network
18s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 16:15

Target

Setup/Setup.exe
Size

703KB
MD5

7c072889c0da91e318c87ba695655d9f
SHA1

d5922afb184e27013d58b6e163519362b8dbc27a
SHA256

d2a42906e2fb62e23325923a4453b7a6a09884f6f7b3863ddf35f50e6ecb4098
SHA512

831895f0cddefea89b016d34bf7f40d6dbe34817b127a8aa54d5724b4595df32c785191599f8582a0904ef26955e0209f9766227083d9208c2ea694facf25675
SSDEEP

12288:FgLAetvCaem2VSn7FJF2oRhdg44dmEzHl0NxUJxzHDH08BEVnMUhDZVOA:hetqaem2En7FJF2o1QdmERzj6N

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2788	1316	WerFault.exe	27

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2788	1316	Setup.exe	29
PID 1316 wrote to memory of 2788	1316	Setup.exe	29
PID 1316 wrote to memory of 2788	1316	Setup.exe	29
PID 1316 wrote to memory of 2788	1316	Setup.exe	29
PID 1316 wrote to memory of 2788	1316	Setup.exe	29
PID 1316 wrote to memory of 2788	1316	Setup.exe	29
PID 1316 wrote to memory of 2788	1316	Setup.exe	29

C:\Users\Admin\AppData\Local\Temp\Setup\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 264
  2⤵
  - Program crash
  PID:2788

memory/1316-0-0x00000000004C0000-0x000000000054C000-memory.dmp

Filesize
560KB

Download
memory/1316-5-0x00000000004C0000-0x000000000054C000-memory.dmp

Filesize
560KB

Download