2aa863205966d370622af1298e751ed5501814854034a81695cd32dd78195753

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 15:50

Target

df898b9c0bef094971510bb6543c30ef.exe
Size

5KB
MD5

df898b9c0bef094971510bb6543c30ef
SHA1

76e64b1be4cb984c881f5d00d346d31232d0c013
SHA256

2aa863205966d370622af1298e751ed5501814854034a81695cd32dd78195753
SHA512

d90de4c48c52477544ef7bc6ccd1f76b3f74fd42e5934bc8a0cae7b1ae3520312054a2dfe0ec38d383b549078a84305aa4071fb863dd672fc53150565bf8e5a7
SSDEEP

48:S2lXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7tqRuqSxp:nWLkFfNnOKYloIQ2pm2pbYSuxE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2968	3032	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2968	3032	df898b9c0bef094971510bb6543c30ef.exe	28
PID 3032 wrote to memory of 2968	3032	df898b9c0bef094971510bb6543c30ef.exe	28
PID 3032 wrote to memory of 2968	3032	df898b9c0bef094971510bb6543c30ef.exe	28
PID 3032 wrote to memory of 2968	3032	df898b9c0bef094971510bb6543c30ef.exe	28

C:\Users\Admin\AppData\Local\Temp\df898b9c0bef094971510bb6543c30ef.exe
"C:\Users\Admin\AppData\Local\Temp\df898b9c0bef094971510bb6543c30ef.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 48
  2⤵
  - Program crash
  PID:2968