7bde1d12ff1ce50967e116119f003ae93e51198b12c06d3cee85a4199389489a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 01:38

Target

7bde1d12ff1ce50967e116119f003ae93e51198b12c06d3cee85a4199389489a.exe
Size

503KB
MD5

665359fe7ad7626ffde7260978ec9470
SHA1

4bf1009eeab5f6644e2caa1305623cc4ced5ea83
SHA256

7bde1d12ff1ce50967e116119f003ae93e51198b12c06d3cee85a4199389489a
SHA512

6e69f4f704f788b17e2213b3a05dde144b2e9385df4450067e352a71d2c353d271b05096924b25c7c044bbbd194124af101ff91cc9945d1b584004c89675c881
SSDEEP

12288:N4SkTUGRODehc/Q+NA1nJesa2L4yivGWp/GCqMWr:N44G+hXsa2L4ygGf1Mk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2916	2856	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2916	2856	7bde1d12ff1ce50967e116119f003ae93e51198b12c06d3cee85a4199389489a.exe	28
PID 2856 wrote to memory of 2916	2856	7bde1d12ff1ce50967e116119f003ae93e51198b12c06d3cee85a4199389489a.exe	28
PID 2856 wrote to memory of 2916	2856	7bde1d12ff1ce50967e116119f003ae93e51198b12c06d3cee85a4199389489a.exe	28
PID 2856 wrote to memory of 2916	2856	7bde1d12ff1ce50967e116119f003ae93e51198b12c06d3cee85a4199389489a.exe	28

C:\Users\Admin\AppData\Local\Temp\7bde1d12ff1ce50967e116119f003ae93e51198b12c06d3cee85a4199389489a.exe
"C:\Users\Admin\AppData\Local\Temp\7bde1d12ff1ce50967e116119f003ae93e51198b12c06d3cee85a4199389489a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 48
  2⤵
  - Program crash
  PID:2916

memory/2856-0-0x0000000000110000-0x0000000000192000-memory.dmp

Filesize
520KB

Download