a16e2ada8d8b81b0204ed70a8a32ce2c602f145b3af841d7e6c8b6ecc908126e

Analysis

max time kernel
28s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
11/02/2023, 02:28

Target
llpb1133.exe
Size 7.4MB
Sample230211-cx1f4aed92
SHA256 a16e2ada8d8b81b0204ed70a8a32ce2c602f145b3af841d7e6c8b6ecc908126e
MD5 48f9aa8e496530a5f2f5fb8c7107ede7
SHA1 1ca1f0d9d31294dca3cafcad447b417c95a4964a
SHA512 ea39bb9a17c935110363e6ae77781969eff234ee6b16b8e230218bc7846375d94b5cd8d1bae00853c38203c3b6f9acc51de1af8b191d60cdc437bb26a9e84187
SSDEEP 196608:uNsBTI1zcGymXkqay6YVFAf5e2tGN1Hkg90rLBBM:kUTO9yoDj6SFW5PEOrFB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1976	2032	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1976	2032	llpb1133.exe	28
PID 2032 wrote to memory of 1976	2032	llpb1133.exe	28
PID 2032 wrote to memory of 1976	2032	llpb1133.exe	28
PID 2032 wrote to memory of 1976	2032	llpb1133.exe	28

C:\Users\Admin\AppData\Local\Temp\llpb1133.exe
"C:\Users\Admin\AppData\Local\Temp\llpb1133.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 548
  2⤵
  - Program crash
  PID:1976

memory/2032-54-0x0000000000C80000-0x00000000013E4000-memory.dmp

Download