7982c34f0ec4dcbc742b0b0d5eef4a6fa4fa3d4d49d6c9e8372e0321a9bd057e

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 05:45

Target

20b2370583df77f622fd7322127f8b19.exe
Size

185KB
MD5

20b2370583df77f622fd7322127f8b19
SHA1

44ee44e10b1e54710a44913943060d9b3bf9ccf1
SHA256

7982c34f0ec4dcbc742b0b0d5eef4a6fa4fa3d4d49d6c9e8372e0321a9bd057e
SHA512

b27c68dac5f8e85a5d612900b283cd4cd5bf67a675d432211d2c5f593044096d52a5178f1cc8914a8ec63a6cab1bcf50c1bf68c2cd3aca91a7a7ed852f127a44
SSDEEP

3072:u2oebIuwgIxqzfhTSgXA4cNNPNNrqNpCuQlNNZuWYH9nsXC8SZcuHRK4eNJqhSNu:u2IuwgLNSFeb/LySylerTW4KSKAhf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1720	1300	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1720	1300	20b2370583df77f622fd7322127f8b19.exe	28
PID 1300 wrote to memory of 1720	1300	20b2370583df77f622fd7322127f8b19.exe	28
PID 1300 wrote to memory of 1720	1300	20b2370583df77f622fd7322127f8b19.exe	28
PID 1300 wrote to memory of 1720	1300	20b2370583df77f622fd7322127f8b19.exe	28

C:\Users\Admin\AppData\Local\Temp\20b2370583df77f622fd7322127f8b19.exe
"C:\Users\Admin\AppData\Local\Temp\20b2370583df77f622fd7322127f8b19.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 36
  2⤵
  - Program crash
  PID:1720

memory/1300-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download