756bd1b6b32fb43874262844d1c398d5ab16a1524b9671af19d7e1049096ac8e

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 13:56

Target

TORONTO.exe
Size

428KB
MD5

f01b98fc5d24395dbc3219624758fe94
SHA1

4ebcbbec3c980d5d8a03be926dbb2608f0163861
SHA256

20577a99d6c3fa639447096644f66fcb1b55b808de87a686749cfc7a658d3c38
SHA512

7fe5c3732657cc6140ff1c53437f43ede9399c2bd2a59722f0f5c59dd8ec064e877f185574236192a219db497febcadc72ac69d9cf931f1fa775cdea36a23f51
SSDEEP

6144:bJollhS4qdxjPxUUsDI6NioQMKNU3dnzeMutErZf5/9B9tuEwnlMLHt/kTpOgsme:9m/SNRuSNU35LyEJfBKEPLHt/q+KU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3064	1728	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 3064	1728	TORONTO.exe	29
PID 1728 wrote to memory of 3064	1728	TORONTO.exe	29
PID 1728 wrote to memory of 3064	1728	TORONTO.exe	29
PID 1728 wrote to memory of 3064	1728	TORONTO.exe	29

C:\Users\Admin\AppData\Local\Temp\TORONTO.exe
"C:\Users\Admin\AppData\Local\Temp\TORONTO.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 36
  2⤵
  - Program crash
  PID:3064

memory/1728-0-0x0000000000270000-0x00000000002CB000-memory.dmp

Filesize
364KB

Download