643d0756821949d55f9579c2fb87dac65805c2867a29b574f19ace7370f785df

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 06:02

Target

c7de4f8880a248113e2c1e241f80a264.exe
Size

8KB
MD5

c7de4f8880a248113e2c1e241f80a264
SHA1

4820734b94dda8b2a04edb6413089ad4f4bf5174
SHA256

643d0756821949d55f9579c2fb87dac65805c2867a29b574f19ace7370f785df
SHA512

b19a64c89c449824613344c4893a9aa8448a6bef086c8fd60c2a5d12f43d9492e3810cf84f6d7a8d3f6a8b363f75313bc14e943d17d810cf36012752aec54ca1
SSDEEP

192:nnSCW3l0vdV+NMqgas3TyICbSoDCeEJ6XRCALOjTwa2l1:ni2vDuXICb5eqR/LOoa27

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1796	3008	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 1796	3008	c7de4f8880a248113e2c1e241f80a264.exe	28
PID 3008 wrote to memory of 1796	3008	c7de4f8880a248113e2c1e241f80a264.exe	28
PID 3008 wrote to memory of 1796	3008	c7de4f8880a248113e2c1e241f80a264.exe	28
PID 3008 wrote to memory of 1796	3008	c7de4f8880a248113e2c1e241f80a264.exe	28

C:\Users\Admin\AppData\Local\Temp\c7de4f8880a248113e2c1e241f80a264.exe
"C:\Users\Admin\AppData\Local\Temp\c7de4f8880a248113e2c1e241f80a264.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 44
  2⤵
  - Program crash
  PID:1796

memory/3008-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3008-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/3008-2-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3008-3-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download