c492c994c97afe0325d499352dbfeb553295c1c31cc180c1e1c484d5c06a246c

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-03-2024 01:02

Target

c7496d563a02ce8d24d8bd929c7c0d5d.exe
Size

118KB
MD5

c7496d563a02ce8d24d8bd929c7c0d5d
SHA1

9117307d464d0f57e8adf6d3839e4a290d180933
SHA256

c492c994c97afe0325d499352dbfeb553295c1c31cc180c1e1c484d5c06a246c
SHA512

2e6f0abaebe6b06fbab60fbf08a521ee7ac9ca1db54a714b8a294e29f9d807b59c01c4bb24a0e7b47e11678b2f413ede7ff9a4778e35af35fa80b4686954f410
SSDEEP

3072:xGNFEWtNkcXD/Nxa4miC0k83fTfI8d88sod/UdZow/e:xCztNkcXD/jtl3/G8s3dyJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3008	2188	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 3008	2188	c7496d563a02ce8d24d8bd929c7c0d5d.exe	28
PID 2188 wrote to memory of 3008	2188	c7496d563a02ce8d24d8bd929c7c0d5d.exe	28
PID 2188 wrote to memory of 3008	2188	c7496d563a02ce8d24d8bd929c7c0d5d.exe	28
PID 2188 wrote to memory of 3008	2188	c7496d563a02ce8d24d8bd929c7c0d5d.exe	28

C:\Users\Admin\AppData\Local\Temp\c7496d563a02ce8d24d8bd929c7c0d5d.exe
"C:\Users\Admin\AppData\Local\Temp\c7496d563a02ce8d24d8bd929c7c0d5d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 36
  2⤵
  - Program crash
  PID:3008

memory/2188-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2188-1-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download