3bd292f68805f53d3ddc7f33db35aa12245793d8c43e1b6cda86efa737d6982f

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15/10/2023, 16:56

Target

3bd292f68805f53d3ddc7f33db35aa12245793d8c43e1b6cda86efa737d6982f.exe
Size

5KB
MD5

267cf1070fc3e4a3b8afd1c0d1cbc140
SHA1

cf4ad3b40b6227b526b5cde08675499ae8d9ef84
SHA256

3bd292f68805f53d3ddc7f33db35aa12245793d8c43e1b6cda86efa737d6982f
SHA512

72195de7c9e3f1e605ad8142420731989096cd4dcdc158a126ae6dcc1aa7809f8d41feb2f2b1f69484e5a1805af1da0629a5f1103e996bd8a0f2f7ae90ebf39d
SSDEEP

48:SeelXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7tARuqSxp:cWLkFfNnOKYloIQ2pm2pbYSMxE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3048	3040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 3048	3040	3bd292f68805f53d3ddc7f33db35aa12245793d8c43e1b6cda86efa737d6982f.exe	28
PID 3040 wrote to memory of 3048	3040	3bd292f68805f53d3ddc7f33db35aa12245793d8c43e1b6cda86efa737d6982f.exe	28
PID 3040 wrote to memory of 3048	3040	3bd292f68805f53d3ddc7f33db35aa12245793d8c43e1b6cda86efa737d6982f.exe	28
PID 3040 wrote to memory of 3048	3040	3bd292f68805f53d3ddc7f33db35aa12245793d8c43e1b6cda86efa737d6982f.exe	28

C:\Users\Admin\AppData\Local\Temp\3bd292f68805f53d3ddc7f33db35aa12245793d8c43e1b6cda86efa737d6982f.exe
"C:\Users\Admin\AppData\Local\Temp\3bd292f68805f53d3ddc7f33db35aa12245793d8c43e1b6cda86efa737d6982f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 48
  2⤵
  - Program crash
  PID:3048