7b3ddd3cd2b3aa8fee45bd3f81e34f7277ff157f86aea91a7b2b28a7f036df0f

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 10:28

Target

9b7048de0bc4a05fc8d6a7fa24fda69d.exe
Size

36KB
MD5

9b7048de0bc4a05fc8d6a7fa24fda69d
SHA1

4ab81bf7810c9160830c75f9a0d96ab039b7219b
SHA256

7b3ddd3cd2b3aa8fee45bd3f81e34f7277ff157f86aea91a7b2b28a7f036df0f
SHA512

5f2f7f274ad54d9f14e2f9d8b84e93c26b5c7e5bcba7414acfc90875ceccb568a204a3e0ca7d2f0aa848d8b3d6bec3589b058a86d6fcf07e60924b81d3185df8
SSDEEP

768:oolu3NBDAfigK8D6ME/nt96vtxniGUnpirxwHvVh4xt7GtZkSsc:os8N7gVD6ME/t90VUnOa4OkS5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2644	2964	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2644	2964	9b7048de0bc4a05fc8d6a7fa24fda69d.exe	28
PID 2964 wrote to memory of 2644	2964	9b7048de0bc4a05fc8d6a7fa24fda69d.exe	28
PID 2964 wrote to memory of 2644	2964	9b7048de0bc4a05fc8d6a7fa24fda69d.exe	28
PID 2964 wrote to memory of 2644	2964	9b7048de0bc4a05fc8d6a7fa24fda69d.exe	28

C:\Users\Admin\AppData\Local\Temp\9b7048de0bc4a05fc8d6a7fa24fda69d.exe
"C:\Users\Admin\AppData\Local\Temp\9b7048de0bc4a05fc8d6a7fa24fda69d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 88
  2⤵
  - Program crash
  PID:2644

memory/2964-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download