fc0a70936e6485ae0ce312ce6ff394d0d21759de4bc9ea9b5e01544d951535c2

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 10:00

Target

77274817210948a1fbb7d40ad1a99460ad22b9558203091765c377ab9b074874.exe
Size

208KB
MD5

47a48930888e190fdf03fb059e7de474
SHA1

c155265a215b375f2caf326bfc614ad164ad3a61
SHA256

77274817210948a1fbb7d40ad1a99460ad22b9558203091765c377ab9b074874
SHA512

a7dc68c80831365592e413e042f4997bc06430d106d202c35df276e4cadcfbbff2ebf53c8d3596382ab8c7a6914b4898e978ec2644db6e66a62d7940da913006
SSDEEP

3072:p3EzoOopVBOQwz9znJTvT8XB6I7Ho5JGbtohOkWgOe1MpcbSBLMspN:pqhonBb09t0ZLWJGpJgrupwSespN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1724	1300	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1724	1300	77274817210948a1fbb7d40ad1a99460ad22b9558203091765c377ab9b074874.exe	29
PID 1300 wrote to memory of 1724	1300	77274817210948a1fbb7d40ad1a99460ad22b9558203091765c377ab9b074874.exe	29
PID 1300 wrote to memory of 1724	1300	77274817210948a1fbb7d40ad1a99460ad22b9558203091765c377ab9b074874.exe	29
PID 1300 wrote to memory of 1724	1300	77274817210948a1fbb7d40ad1a99460ad22b9558203091765c377ab9b074874.exe	29

C:\Users\Admin\AppData\Local\Temp\77274817210948a1fbb7d40ad1a99460ad22b9558203091765c377ab9b074874.exe
"C:\Users\Admin\AppData\Local\Temp\77274817210948a1fbb7d40ad1a99460ad22b9558203091765c377ab9b074874.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 52
  2⤵
  - Program crash
  PID:1724

memory/1300-0-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/1300-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download