baff3039b9acf97084d1b853f495026c52a4c483d010901e226beb599d23df5b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 04:43

Target

c72e70f29d3dd8fa148df55e8e6dec43.exe
Size

1.8MB
MD5

c72e70f29d3dd8fa148df55e8e6dec43
SHA1

2f182d43528f78d6d847b37b77da9a09a2ed1f0a
SHA256

baff3039b9acf97084d1b853f495026c52a4c483d010901e226beb599d23df5b
SHA512

d1923e33057413d478daaaaa54bb157762172a58ae03fc36e0c1c6e4d64c0c33d08bff7aec8759f533331215960d739fec2ffea86d18d1d8a70105927a6a5f12
SSDEEP

49152:XZKDuL48I2oJDxrV/4ePVhfBHcXuCEe/vPOM6yWKp3+EmfOS:XZ2uL439144fCXubCv2M6yWy3+i

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2376	824	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 2376	824	c72e70f29d3dd8fa148df55e8e6dec43.exe	28
PID 824 wrote to memory of 2376	824	c72e70f29d3dd8fa148df55e8e6dec43.exe	28
PID 824 wrote to memory of 2376	824	c72e70f29d3dd8fa148df55e8e6dec43.exe	28
PID 824 wrote to memory of 2376	824	c72e70f29d3dd8fa148df55e8e6dec43.exe	28

C:\Users\Admin\AppData\Local\Temp\c72e70f29d3dd8fa148df55e8e6dec43.exe
"C:\Users\Admin\AppData\Local\Temp\c72e70f29d3dd8fa148df55e8e6dec43.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 108
  2⤵
  - Program crash
  PID:2376

memory/824-0-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download