79725aa6ccf0569534262e0e86a0cdba7e1991b7fd07306527684cde5e71c834

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 23:19

Target

79725aa6ccf0569534262e0e86a0cdba7e1991b7fd07306527684cde5e71c834.exe
Size

149KB
MD5

f150ac06fb0bf959a211dc834d140dd2
SHA1

be9ace8daf4445c190525491a7cc85a5fa029f40
SHA256

79725aa6ccf0569534262e0e86a0cdba7e1991b7fd07306527684cde5e71c834
SHA512

0e91a5ebd8edc6711cbc7676a752454114f9020af1ccd932b27ea574501dfac696397ed2412b163dd0815beb0e960ee58fb16bd59bdbce6f1d99f0e7fcea194f
SSDEEP

3072:lrYgJesaifvyxyvZcMO/6T4nIB5BAZlB/:lp5aqqAZcR/6TkINwl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
864	2040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 864	2040	79725aa6ccf0569534262e0e86a0cdba7e1991b7fd07306527684cde5e71c834.exe	28
PID 2040 wrote to memory of 864	2040	79725aa6ccf0569534262e0e86a0cdba7e1991b7fd07306527684cde5e71c834.exe	28
PID 2040 wrote to memory of 864	2040	79725aa6ccf0569534262e0e86a0cdba7e1991b7fd07306527684cde5e71c834.exe	28
PID 2040 wrote to memory of 864	2040	79725aa6ccf0569534262e0e86a0cdba7e1991b7fd07306527684cde5e71c834.exe	28

C:\Users\Admin\AppData\Local\Temp\79725aa6ccf0569534262e0e86a0cdba7e1991b7fd07306527684cde5e71c834.exe
"C:\Users\Admin\AppData\Local\Temp\79725aa6ccf0569534262e0e86a0cdba7e1991b7fd07306527684cde5e71c834.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 136
  2⤵
  - Program crash
  PID:864

memory/2040-0-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download