b99e7a2211d2098ca319e3e016897a582b691d06bd61bf552d0a80eed6587ed0

Analysis

max time kernel
140s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 11:14

Target

services.exe
Size

43KB
MD5

aee6ddcc753bd7e6e739012e89e98c86
SHA1

d8ff34c145142255147e9297cadaf903b2df8423
SHA256

afe4a08c9c3bd7dc593b4c342d9bf814a08ae156cefc20df971bd7ae37cb7745
SHA512

4b6aaaeadcc6b765e8022d76135a68aa9c44f0e406f42d4988afac8fc55a76b0fb55dcf578c23c38edc0e537189c8efbc4fef703846167c9390d791c534b9f63
SSDEEP

768:f7Hg0lkM0FFrhQIX1IbJ+3G9h/r82hZ53WSdbXko/J0s9EYk7GMHHmHgjdySuXn6:jg00VX1OhDVhD3WEr5a/YknHGqd2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2364	2528	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2364	2528	services.exe	29
PID 2528 wrote to memory of 2364	2528	services.exe	29
PID 2528 wrote to memory of 2364	2528	services.exe	29
PID 2528 wrote to memory of 2364	2528	services.exe	29

C:\Users\Admin\AppData\Local\Temp\services.exe
"C:\Users\Admin\AppData\Local\Temp\services.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 88
  2⤵
  - Program crash
  PID:2364

memory/2528-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download