bbb8b8fa9afc6a6001eebc72f4fbd99a274a18c0cebf95837247daf1e09a5c41

Analysis

max time kernel
89s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 17:06

Target

bbb8b8fa9afc6a6001eebc72f4fbd99a274a18c0cebf95837247daf1e09a5c41.exe
Size

32KB
MD5

79974a791487e9edd88ad598d4f97619
SHA1

618cc32f6f81ac77bd2a5d1fd07f3982455d1efd
SHA256

bbb8b8fa9afc6a6001eebc72f4fbd99a274a18c0cebf95837247daf1e09a5c41
SHA512

74200c088bcc11ad5f4dcb2e985ba384183ecce1188ebde5699f334f50c49d3549b56e1ea7c6f291b6f8df2062c55931de5dd782c7a7384fa2f4fb311ab11c05
SSDEEP

384:Lga5h0kCu2grzkld3yNjRfLojcxlwbSzRINbZOYE76up4dp:UQh0DuxMRyNVfMjmmSOjQmupW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
568	1116	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 568	1116	bbb8b8fa9afc6a6001eebc72f4fbd99a274a18c0cebf95837247daf1e09a5c41.exe	28
PID 1116 wrote to memory of 568	1116	bbb8b8fa9afc6a6001eebc72f4fbd99a274a18c0cebf95837247daf1e09a5c41.exe	28
PID 1116 wrote to memory of 568	1116	bbb8b8fa9afc6a6001eebc72f4fbd99a274a18c0cebf95837247daf1e09a5c41.exe	28
PID 1116 wrote to memory of 568	1116	bbb8b8fa9afc6a6001eebc72f4fbd99a274a18c0cebf95837247daf1e09a5c41.exe	28

C:\Users\Admin\AppData\Local\Temp\bbb8b8fa9afc6a6001eebc72f4fbd99a274a18c0cebf95837247daf1e09a5c41.exe
"C:\Users\Admin\AppData\Local\Temp\bbb8b8fa9afc6a6001eebc72f4fbd99a274a18c0cebf95837247daf1e09a5c41.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 88
  2⤵
  - Program crash
  PID:568

memory/1116-55-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download