01bc3f4a1c16f154eb99aabc8e2c012ed72bfbaa5c56bb1b66768f3b8f684577

Analysis

max time kernel
117s
max time network
130s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 21:34

Target

01bc3f4a1c16f154eb99aabc8e2c012ed72bfbaa5c56bb1b66768f3b8f684577.exe
Size

113KB
MD5

5daabe3ea15c3bb2b678745089b1e4c0
SHA1

9bc78e75e2ced32a383c6e04ef5daf787a3a4d8b
SHA256

01bc3f4a1c16f154eb99aabc8e2c012ed72bfbaa5c56bb1b66768f3b8f684577
SHA512

cfb23dbb0c9b071bbc56d2899a4eca8d344a7453ad339cc52f4b1a749dd20ae7de70bb3afe316dcc07b218eb04033bb8109791adc24624c92677fa14834b26bf
SSDEEP

1536:qiinKRUU2csfWQ42ZRsy/sJ1GYrcSTwnQOG4N/guze0DzzzzzzzzzzzGK/Dzzzz9:qiDRUU2Jv/ZIJ1ZN0nQMzf2S2j2v

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2804	2824	WerFault.exe	24

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2804	2824	01bc3f4a1c16f154eb99aabc8e2c012ed72bfbaa5c56bb1b66768f3b8f684577.exe	30
PID 2824 wrote to memory of 2804	2824	01bc3f4a1c16f154eb99aabc8e2c012ed72bfbaa5c56bb1b66768f3b8f684577.exe	30
PID 2824 wrote to memory of 2804	2824	01bc3f4a1c16f154eb99aabc8e2c012ed72bfbaa5c56bb1b66768f3b8f684577.exe	30
PID 2824 wrote to memory of 2804	2824	01bc3f4a1c16f154eb99aabc8e2c012ed72bfbaa5c56bb1b66768f3b8f684577.exe	30

C:\Users\Admin\AppData\Local\Temp\01bc3f4a1c16f154eb99aabc8e2c012ed72bfbaa5c56bb1b66768f3b8f684577.exe
"C:\Users\Admin\AppData\Local\Temp\01bc3f4a1c16f154eb99aabc8e2c012ed72bfbaa5c56bb1b66768f3b8f684577.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 636
  2⤵
  - Program crash
  PID:2804

memory/2824-0-0x00000000741C0000-0x00000000748AE000-memory.dmp

Filesize
6.9MB

Download
memory/2824-1-0x00000000009B0000-0x00000000009D2000-memory.dmp

Filesize
136KB

Download
memory/2824-2-0x00000000741C0000-0x00000000748AE000-memory.dmp

Filesize
6.9MB

Download
memory/2824-3-0x0000000004DA0000-0x0000000004DE0000-memory.dmp

Filesize
256KB

Download
memory/2824-4-0x0000000004DA0000-0x0000000004DE0000-memory.dmp

Filesize
256KB

Download