8478e5378386bc1d0fdd55680786d2ec893cb5ada34811f7bc92ebed1a6a08a1

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-02-2024 23:37

Target

aa70cf1a38be5591b2f3780de4480da9.exe
Size

83KB
MD5

aa70cf1a38be5591b2f3780de4480da9
SHA1

3a02bd83633699ed58be44308b7219c19e58abc8
SHA256

8478e5378386bc1d0fdd55680786d2ec893cb5ada34811f7bc92ebed1a6a08a1
SHA512

944de2cbd96c82b3c07da6a27c03a26e6135705a8c1cbc4d20085c649e792d55440e76e60c24e455b3879222735a301b1580440f8bc3b36c9d640da2d66706ed
SSDEEP

1536:Q+a3/3lmw36ZrMum+0snhOBJXfIbhr4CYLNT8zNPjEErxTWDTMqhGKYIZTET8bDQ:g/3lmS6ZgshsxjVRT8JjBkMqhGKZTbbc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2172	1964	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2172	1964	aa70cf1a38be5591b2f3780de4480da9.exe	28
PID 1964 wrote to memory of 2172	1964	aa70cf1a38be5591b2f3780de4480da9.exe	28
PID 1964 wrote to memory of 2172	1964	aa70cf1a38be5591b2f3780de4480da9.exe	28
PID 1964 wrote to memory of 2172	1964	aa70cf1a38be5591b2f3780de4480da9.exe	28

C:\Users\Admin\AppData\Local\Temp\aa70cf1a38be5591b2f3780de4480da9.exe
"C:\Users\Admin\AppData\Local\Temp\aa70cf1a38be5591b2f3780de4480da9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 36
  2⤵
  - Program crash
  PID:2172

memory/1964-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download