7790d320a8f99b48178c375dc7074e37fbb5939cc7ceed3cb0aeb9afe2065335

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 08:41

Target

c82f35b86684822c7f22e0015920f17e.exe
Size

13KB
MD5

c82f35b86684822c7f22e0015920f17e
SHA1

a16911b5f0ee4a7c3c6ca7ea78bd608b76e92973
SHA256

7790d320a8f99b48178c375dc7074e37fbb5939cc7ceed3cb0aeb9afe2065335
SHA512

fdbace1378a8ee53f958eae5fcf4ad6000c4a96a7b8b4eb9badc237ebfec5a02ad061a76496d9fdcc83ed0ff95cead2b8b745a9825adc7ce0849d0e6c2d571e7
SSDEEP

192:3zsPI4WvHv6zE0X381DGzMLUAAR/ZxnN9wWwzQ1FfYJlmNW:3zsnW/2Ews1DGzMLxARx1PwWMQQM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1692	2180	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1692	2180	c82f35b86684822c7f22e0015920f17e.exe	28
PID 2180 wrote to memory of 1692	2180	c82f35b86684822c7f22e0015920f17e.exe	28
PID 2180 wrote to memory of 1692	2180	c82f35b86684822c7f22e0015920f17e.exe	28
PID 2180 wrote to memory of 1692	2180	c82f35b86684822c7f22e0015920f17e.exe	28

C:\Users\Admin\AppData\Local\Temp\c82f35b86684822c7f22e0015920f17e.exe
"C:\Users\Admin\AppData\Local\Temp\c82f35b86684822c7f22e0015920f17e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 36
  2⤵
  - Program crash
  PID:1692

memory/2180-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2180-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download