94169b9d280c207d56da08193ebd46e3e4560d35e3e18642895ae2c84e61aef3

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 04:31

Target

ca7ec7d564c8b286be799f543d6cccc8.exe
Size

427KB
MD5

ca7ec7d564c8b286be799f543d6cccc8
SHA1

3c8209960beece8490d37f6b222bdf626d6f01c8
SHA256

94169b9d280c207d56da08193ebd46e3e4560d35e3e18642895ae2c84e61aef3
SHA512

8a40374c868f696f8942c756150f92a0f46393d699647a5a88f3bc9d71b54d40e62ed116764a3331b5c360e04662b1ebfb6dfd5b9d05b036638e8b509878ff6a
SSDEEP

6144:aiFUvYoYDm5v8DJtBTd8dbVTh2adDWAzuroj3zjlYL1Q3R9E:aigYLm5EDJtBJ8hrlurovhfR9E

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	2012	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1708	2012	ca7ec7d564c8b286be799f543d6cccc8.exe	28
PID 2012 wrote to memory of 1708	2012	ca7ec7d564c8b286be799f543d6cccc8.exe	28
PID 2012 wrote to memory of 1708	2012	ca7ec7d564c8b286be799f543d6cccc8.exe	28
PID 2012 wrote to memory of 1708	2012	ca7ec7d564c8b286be799f543d6cccc8.exe	28

C:\Users\Admin\AppData\Local\Temp\ca7ec7d564c8b286be799f543d6cccc8.exe
"C:\Users\Admin\AppData\Local\Temp\ca7ec7d564c8b286be799f543d6cccc8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 116
  2⤵
  - Program crash
  PID:1708

memory/2012-0-0x0000000000D40000-0x0000000000DAF000-memory.dmp

Filesize
444KB

Download