2c41c8fdf28d02d3acd92c7effbe788f0c1f0d436b3f338c5e008cbb37b42d79

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 06:48

Target

c7f598dea6ce741616040f5d72d6efa9.exe
Size

59KB
MD5

c7f598dea6ce741616040f5d72d6efa9
SHA1

45d9d952b8543e0d69abae5b887fecc9979dd0be
SHA256

2c41c8fdf28d02d3acd92c7effbe788f0c1f0d436b3f338c5e008cbb37b42d79
SHA512

2311c310cf0194cae70aa785162d44f0a8654a9fb8854640996b0ec34eb6cf17953661ea009a9963272b3e0a9a2855da4b90402f42fc840b0973a9745cfec9ac
SSDEEP

1536:gVQryZ8zqUV8cuz9L2aMGiD4JK/+EX6TD1sIJX+uMUfKN:CQr+8WUV7aMGi/uDqIl+udKN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	2032	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1728	2032	c7f598dea6ce741616040f5d72d6efa9.exe	28
PID 2032 wrote to memory of 1728	2032	c7f598dea6ce741616040f5d72d6efa9.exe	28
PID 2032 wrote to memory of 1728	2032	c7f598dea6ce741616040f5d72d6efa9.exe	28
PID 2032 wrote to memory of 1728	2032	c7f598dea6ce741616040f5d72d6efa9.exe	28

C:\Users\Admin\AppData\Local\Temp\c7f598dea6ce741616040f5d72d6efa9.exe
"C:\Users\Admin\AppData\Local\Temp\c7f598dea6ce741616040f5d72d6efa9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 92
  2⤵
  - Program crash
  PID:1728