23da57e09c6003ce6c7bcb75c7086407a0a78efab0c682eab8a15cc223c129a8

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 23:07

Target

c713d61e0564fd69514b974624cd4ca5.exe
Size

58KB
MD5

c713d61e0564fd69514b974624cd4ca5
SHA1

f9c719533f101a353bc43c46d49be7d1b74a5a74
SHA256

23da57e09c6003ce6c7bcb75c7086407a0a78efab0c682eab8a15cc223c129a8
SHA512

5794b206f75264f315caee12986ce3d3e9091b8158e7686df9e3885ecbbcbc21f2b0915202dd8e5070aa0ed7938c1614589c7dc2c6424e3e94cb46d792da7c1c
SSDEEP

768:qBDZaY795hwSpIkemQSWOQbrADfGLBYe/WntlZqxooZuRkeL8Ul5QcIjTNT/:qBNjnhmkJ0TBYeOtnoZkwa+cIjTB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	1032	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1708	1032	c713d61e0564fd69514b974624cd4ca5.exe	28
PID 1032 wrote to memory of 1708	1032	c713d61e0564fd69514b974624cd4ca5.exe	28
PID 1032 wrote to memory of 1708	1032	c713d61e0564fd69514b974624cd4ca5.exe	28
PID 1032 wrote to memory of 1708	1032	c713d61e0564fd69514b974624cd4ca5.exe	28

C:\Users\Admin\AppData\Local\Temp\c713d61e0564fd69514b974624cd4ca5.exe
"C:\Users\Admin\AppData\Local\Temp\c713d61e0564fd69514b974624cd4ca5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 88
  2⤵
  - Program crash
  PID:1708

memory/1032-0-0x0000000000400000-0x000000000040F6AB-memory.dmp

Filesize
61KB

Download
memory/1032-1-0x0000000000400000-0x000000000040F6AB-memory.dmp

Filesize
61KB

Download