b41dcf1d5ec307238a14cf522851abca987fe5f61edad50c98533d771d22d193

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
04-09-2023 10:34

Target

b41dcf1d5ec307238a14cf522851abca987fe5f61edad50c98533d771d22d193.exe
Size

1.9MB
MD5

ef161743e2c37676daaaa1af7829b827
SHA1

6a2a3aaf590cc34ee8a33b6fa9c43925c3b6ff5a
SHA256

b41dcf1d5ec307238a14cf522851abca987fe5f61edad50c98533d771d22d193
SHA512

a14c0857e651d4fc20c4f1c1d9de06d9b641f44c992e3191054a3baf0dc4b5efb27df3798b449009564e90ef4d7b10a104c5e997902e67bf00d0f1b561de9a77
SSDEEP

49152:lNd++Llb0HAGenfmojMac0qCpx3w5OMjUfkptVxp:jxlbO7EeojMac6TojUu5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2364	2124	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2364	2124	b41dcf1d5ec307238a14cf522851abca987fe5f61edad50c98533d771d22d193.exe	28
PID 2124 wrote to memory of 2364	2124	b41dcf1d5ec307238a14cf522851abca987fe5f61edad50c98533d771d22d193.exe	28
PID 2124 wrote to memory of 2364	2124	b41dcf1d5ec307238a14cf522851abca987fe5f61edad50c98533d771d22d193.exe	28
PID 2124 wrote to memory of 2364	2124	b41dcf1d5ec307238a14cf522851abca987fe5f61edad50c98533d771d22d193.exe	28

C:\Users\Admin\AppData\Local\Temp\b41dcf1d5ec307238a14cf522851abca987fe5f61edad50c98533d771d22d193.exe
"C:\Users\Admin\AppData\Local\Temp\b41dcf1d5ec307238a14cf522851abca987fe5f61edad50c98533d771d22d193.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 196
  2⤵
  - Program crash
  PID:2364