966c2705afb1c7ce76a331579752d5de946a7792719bfe2d6e6aae767647c1b1

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 21:40

Target

d72c754d40ac500e2de05a1829ed6ff7.exe
Size

115KB
MD5

d72c754d40ac500e2de05a1829ed6ff7
SHA1

8d82addd07f2cd379f4113c2f957a6bb588fbcf8
SHA256

966c2705afb1c7ce76a331579752d5de946a7792719bfe2d6e6aae767647c1b1
SHA512

071de5dd0bf04243930337e3acb6ee74626bd778d6dfa127f4dd2496ffd40199fdf72ddb95425cf3784fbdcebd1e372057a6006a9c2c72407780cbe6e85e9fbd
SSDEEP

1536:YpcvxDp5H3c0TPD46N5wIueqrMU1rBc12CzkkG41su9Mt/rX6gJGq0HqonoAcXop:7Bf/bN59ueqrT2ajJtrKg+jnpcKB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2916	2872	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2916	2872	d72c754d40ac500e2de05a1829ed6ff7.exe	28
PID 2872 wrote to memory of 2916	2872	d72c754d40ac500e2de05a1829ed6ff7.exe	28
PID 2872 wrote to memory of 2916	2872	d72c754d40ac500e2de05a1829ed6ff7.exe	28
PID 2872 wrote to memory of 2916	2872	d72c754d40ac500e2de05a1829ed6ff7.exe	28

C:\Users\Admin\AppData\Local\Temp\d72c754d40ac500e2de05a1829ed6ff7.exe
"C:\Users\Admin\AppData\Local\Temp\d72c754d40ac500e2de05a1829ed6ff7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 36
  2⤵
  - Program crash
  PID:2916

memory/2872-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download