b03028acf3fa7be8b588c8e208c3b9bf3c63ecf3f4708e2a16856303218fbf7c

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02-09-2023 07:31

Target

b03028acf3fa7be8b588c8e208c3b9bf3c63ecf3f4708e2a16856303218fbf7c.exe
Size

744KB
MD5

117ce5a0f0f4eaed6fdf148fde2c2f0c
SHA1

3d9a0dfeb2e75a97fefc40b14b4c1eebda4c043d
SHA256

b03028acf3fa7be8b588c8e208c3b9bf3c63ecf3f4708e2a16856303218fbf7c
SHA512

8b713bfc842a58d61b9be30b9e9bfd0abe7e6d752b2941d553ef45d2bdd180e290f16d8fb8bef34d0036da78bab7574ddf201b71651a2eae0224233075b2021a
SSDEEP

12288:UtowhNf/ZpdS7B6HAZQ1xJQA+XBiEKJINctTKNdvxQZbxqLzCvnBB:UxpdS77BiEKJztTKNxqEHCvv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
840	2828	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 840	2828	b03028acf3fa7be8b588c8e208c3b9bf3c63ecf3f4708e2a16856303218fbf7c.exe	28
PID 2828 wrote to memory of 840	2828	b03028acf3fa7be8b588c8e208c3b9bf3c63ecf3f4708e2a16856303218fbf7c.exe	28
PID 2828 wrote to memory of 840	2828	b03028acf3fa7be8b588c8e208c3b9bf3c63ecf3f4708e2a16856303218fbf7c.exe	28
PID 2828 wrote to memory of 840	2828	b03028acf3fa7be8b588c8e208c3b9bf3c63ecf3f4708e2a16856303218fbf7c.exe	28

C:\Users\Admin\AppData\Local\Temp\b03028acf3fa7be8b588c8e208c3b9bf3c63ecf3f4708e2a16856303218fbf7c.exe
"C:\Users\Admin\AppData\Local\Temp\b03028acf3fa7be8b588c8e208c3b9bf3c63ecf3f4708e2a16856303218fbf7c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 196
  2⤵
  - Program crash
  PID:840