e26fabd2c7ff2793a03e50751c6b5c5606cd0dcc9f0fbec237db01080085c327

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 15:01

Target

265074d78c68ba95d07246920d7362962c973dc99f27f0f0a587385fa5df10d6.exe
Size

332KB
MD5

f5db97e3fb356e1566ca0b936eb39b5a
SHA1

6c5d9508a6e3e984dab15d33a78139ec2b61a388
SHA256

265074d78c68ba95d07246920d7362962c973dc99f27f0f0a587385fa5df10d6
SHA512

23f5c86847407d952d9f8b1081dcdeb1e65073f9938ff5adcc27e9407a16e8b7737eebb7a9771602a8864336441d83b6ef92d6708752bc2aca43323320674742
SSDEEP

6144:m3bwLnnURJgoKFr+7hoIJeNRuygh5N4e7DF4AQILHZK644tsR+0Xp:mLzRJgoKFrt4ygHNPBdHZKAt70Xp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	1560	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 2028	1560	265074d78c68ba95d07246920d7362962c973dc99f27f0f0a587385fa5df10d6.exe	29
PID 1560 wrote to memory of 2028	1560	265074d78c68ba95d07246920d7362962c973dc99f27f0f0a587385fa5df10d6.exe	29
PID 1560 wrote to memory of 2028	1560	265074d78c68ba95d07246920d7362962c973dc99f27f0f0a587385fa5df10d6.exe	29
PID 1560 wrote to memory of 2028	1560	265074d78c68ba95d07246920d7362962c973dc99f27f0f0a587385fa5df10d6.exe	29

C:\Users\Admin\AppData\Local\Temp\265074d78c68ba95d07246920d7362962c973dc99f27f0f0a587385fa5df10d6.exe
"C:\Users\Admin\AppData\Local\Temp\265074d78c68ba95d07246920d7362962c973dc99f27f0f0a587385fa5df10d6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 52
  2⤵
  - Program crash
  PID:2028

memory/1560-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/1560-0-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download