108e554f9a900d232f2156033cd9339f1316843befbeaf809f3bdb9186b6970e

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/02/2024, 20:51

Target
af70fcf0d4032564a34f82a4cda2ae87.exe
Size 160KB
Sample240229-znf3escc2s
SHA256 108e554f9a900d232f2156033cd9339f1316843befbeaf809f3bdb9186b6970e
MD5 af70fcf0d4032564a34f82a4cda2ae87
SHA1 ee316a23ecbb38933e0900da3f6db73470f664f5
SHA512 7715435ec4872a1fb2beec46eedf10cf37ffef6a0cb9a5c07956e6636b5f19e34b3597befe8f5cf98c2ae1e0ca5488fca88f3fe2349fa8a9e5214ed26d3c5366
SSDEEP 3072:JP24nrk3mmJ+4o4W4IeooDto6djDcOIjNE+y78Z+C6Pr+HFkYI:JbUo4W4Iey2oNi78ZR6PyHFLI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1668	2920	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 1668	2920	af70fcf0d4032564a34f82a4cda2ae87.exe	28
PID 2920 wrote to memory of 1668	2920	af70fcf0d4032564a34f82a4cda2ae87.exe	28
PID 2920 wrote to memory of 1668	2920	af70fcf0d4032564a34f82a4cda2ae87.exe	28
PID 2920 wrote to memory of 1668	2920	af70fcf0d4032564a34f82a4cda2ae87.exe	28

C:\Users\Admin\AppData\Local\Temp\af70fcf0d4032564a34f82a4cda2ae87.exe
"C:\Users\Admin\AppData\Local\Temp\af70fcf0d4032564a34f82a4cda2ae87.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 164
  2⤵
  - Program crash
  PID:1668

memory/2920-0-0x0000000000400000-0x000000000044A000-memory.dmp

Download