fb3bc50720903bf71fd6f2f374593dd2954a85943f27b75cf8706154719df52c

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16/08/2023, 22:40

Target

fb3bc50720903bf71fd6f2f374593dd2954a85943f27b75cf8706154719df52c.exe
Size

6.0MB
MD5

07f9790342ff86944479ce1c1ed25d9d
SHA1

6cb8d3be6df8e4325f4103cee2d3fddd3f0a8cfa
SHA256

fb3bc50720903bf71fd6f2f374593dd2954a85943f27b75cf8706154719df52c
SHA512

9045073770670d6ef983b38cd2aeddac803b7c26e3bc6b60f636abba586c147baf5979e41619f7240e30745f74c734273db912b9f068bdb8a4467231bbea992b
SSDEEP

49152:69GGQDD7wvOxovNh0TLTUTGjqwj0AqRPVRmbPT1DGBr7arnzhppEIzK9kdTXu1w:6cG8wvYaNhEVQAQPzmbPhYwFXMw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2600	1928	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2600	1928	fb3bc50720903bf71fd6f2f374593dd2954a85943f27b75cf8706154719df52c.exe	28
PID 1928 wrote to memory of 2600	1928	fb3bc50720903bf71fd6f2f374593dd2954a85943f27b75cf8706154719df52c.exe	28
PID 1928 wrote to memory of 2600	1928	fb3bc50720903bf71fd6f2f374593dd2954a85943f27b75cf8706154719df52c.exe	28
PID 1928 wrote to memory of 2600	1928	fb3bc50720903bf71fd6f2f374593dd2954a85943f27b75cf8706154719df52c.exe	28

C:\Users\Admin\AppData\Local\Temp\fb3bc50720903bf71fd6f2f374593dd2954a85943f27b75cf8706154719df52c.exe
"C:\Users\Admin\AppData\Local\Temp\fb3bc50720903bf71fd6f2f374593dd2954a85943f27b75cf8706154719df52c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 220
  2⤵
  - Program crash
  PID:2600

memory/1928-54-0x0000000000400000-0x0000000000A0F000-memory.dmp

Filesize
6.1MB

Download