7ee91634becea4be35e340519e5a454c26e345af6557f430e38d1c2cbbfc0f7e

Analysis

max time kernel
1s
max time network
70s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 01:38

Target
InstallYourTool.exe
Size 782.2MB
Sample240227-b2gdcadc98
SHA256 7ee91634becea4be35e340519e5a454c26e345af6557f430e38d1c2cbbfc0f7e
MD5 045feadc7648e83e8e33535cb6246f4b
SHA1 36db3feed26eb8d78432837e9588abc738f5d50d
SHA512 093c30fc86b396330f4a12a61223862eb7f3be8443c556a648822b8c12d2201cc3ea4aadc8b9a62f8687607fb426522d98d9d3d31aeed6962d8d9c28c8df60f0
SSDEEP 98304:p1fcWTdfcq0BdBNuV9/Wm3R5oiet8fe79vZtc8c8c8c8c8c8c8c8c8c8c8c8c8cw:pnTd/BV9Q3t8feT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2392	656	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 2392	656	InstallYourTool.exe	30
PID 656 wrote to memory of 2392	656	InstallYourTool.exe	30
PID 656 wrote to memory of 2392	656	InstallYourTool.exe	30
PID 656 wrote to memory of 2392	656	InstallYourTool.exe	30

C:\Users\Admin\AppData\Local\Temp\InstallYourTool.exe
"C:\Users\Admin\AppData\Local\Temp\InstallYourTool.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 124
  2⤵
  - Program crash
  PID:2392

memory/656-0-0x0000000001050000-0x00000000014CE000-memory.dmp

Download

memory/656-2-0x0000000000140000-0x0000000000141000-memory.dmp

Download