7956f2479300a4b8532afcc9f9a6ebb62262ddf33c2773fb540ea3b58c73fed5

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 10:38

Target

7956f2479300a4b8532afcc9f9a6ebb62262ddf33c2773fb540ea3b58c73fed5.exe
Size

858KB
MD5

9a5faf2d13c1fb4ac9aa52154c3a6dc5
SHA1

dc60265245e1324833800a26cf05c0d948824a19
SHA256

7956f2479300a4b8532afcc9f9a6ebb62262ddf33c2773fb540ea3b58c73fed5
SHA512

ce74b5c9ab486ce658e4e5f863bb04568fb1754f8688368bb1f10af41ae6333b826b0ff8300558cd7e8de870da658db3d296ce8b538aca7a30426df304095ab1
SSDEEP

12288:0+2iNxAypLcLJ3O/XrFz4seGNIR3XJ2uvFTdUHFoC/vTdNbu6mO0Ul1IHKp:0+1bAypc+/rFMRWs3d0FoCjv1tIqp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2640	2080	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2640	2080	7956f2479300a4b8532afcc9f9a6ebb62262ddf33c2773fb540ea3b58c73fed5.exe	30
PID 2080 wrote to memory of 2640	2080	7956f2479300a4b8532afcc9f9a6ebb62262ddf33c2773fb540ea3b58c73fed5.exe	30
PID 2080 wrote to memory of 2640	2080	7956f2479300a4b8532afcc9f9a6ebb62262ddf33c2773fb540ea3b58c73fed5.exe	30
PID 2080 wrote to memory of 2640	2080	7956f2479300a4b8532afcc9f9a6ebb62262ddf33c2773fb540ea3b58c73fed5.exe	30

C:\Users\Admin\AppData\Local\Temp\7956f2479300a4b8532afcc9f9a6ebb62262ddf33c2773fb540ea3b58c73fed5.exe
"C:\Users\Admin\AppData\Local\Temp\7956f2479300a4b8532afcc9f9a6ebb62262ddf33c2773fb540ea3b58c73fed5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 836
  2⤵
  - Program crash
  PID:2640

memory/2080-0-0x00000000740AE000-0x00000000740AF000-memory.dmp

Filesize
4KB

Download
memory/2080-1-0x0000000000BB0000-0x0000000000C8C000-memory.dmp

Filesize
880KB

Download
memory/2080-2-0x00000000740A0000-0x000000007478E000-memory.dmp

Filesize
6.9MB

Download
memory/2080-3-0x0000000000790000-0x00000000007AA000-memory.dmp

Filesize
104KB

Download
memory/2080-4-0x0000000002090000-0x000000000209E000-memory.dmp

Filesize
56KB

Download
memory/2080-5-0x00000000740AE000-0x00000000740AF000-memory.dmp

Filesize
4KB

Download
memory/2080-6-0x00000000740A0000-0x000000007478E000-memory.dmp

Filesize
6.9MB

Download