8727bf81602271ae93fc3662ed1b046aec1ee74feb07b592221b399c832d1924

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17/03/2024, 09:28

Target
d0855972e11ca09c1c107a23020ed7f7.exe
Size 116KB
Sample240317-lfggbsbc82
SHA256 8727bf81602271ae93fc3662ed1b046aec1ee74feb07b592221b399c832d1924
MD5 d0855972e11ca09c1c107a23020ed7f7
SHA1 a24db268e6ed531e64fbff740f4407c624aa1585
SHA512 685be42b2d806e594fb4249444ad0b94a0e93aea50f569933589d623a50b0fb9f9afb4f570308cfade3e63fb70eb589d39925d591e78ae8203326cc492d482f4
SSDEEP 3072:BdNJd2MbLLKY8pqmJzlXBuvKae7Ewj9KC98zHRAMa2UG8eF:AMOY8pq4BuvPeT98zRYfG8eF
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2792	2936	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2792	2936	d0855972e11ca09c1c107a23020ed7f7.exe	28
PID 2936 wrote to memory of 2792	2936	d0855972e11ca09c1c107a23020ed7f7.exe	28
PID 2936 wrote to memory of 2792	2936	d0855972e11ca09c1c107a23020ed7f7.exe	28
PID 2936 wrote to memory of 2792	2936	d0855972e11ca09c1c107a23020ed7f7.exe	28

C:\Users\Admin\AppData\Local\Temp\d0855972e11ca09c1c107a23020ed7f7.exe
"C:\Users\Admin\AppData\Local\Temp\d0855972e11ca09c1c107a23020ed7f7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 148
  2⤵
  - Program crash
  PID:2792

memory/2936-0-0x0000000000400000-0x000000000041E000-memory.dmp

Download