bf96ba987b06e5d1eb0b2e3a714f8b31a1b94e5dd867c87bd554f979d6ed41dd

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 16:07

Target

2bcfd6c06e651641fa0b5b5571d7467a.exe
Size

368KB
MD5

2bcfd6c06e651641fa0b5b5571d7467a
SHA1

06e0692d56fd3500bb052175dddb036782ea2220
SHA256

bf96ba987b06e5d1eb0b2e3a714f8b31a1b94e5dd867c87bd554f979d6ed41dd
SHA512

9283922d2f2f7df89337581a9783f7ce80e5454cf88573d0e943a03f888a0852367980be360cdd4a457d98b548bde796e15bec4d57c574ca5053ea356e8fbf95
SSDEEP

6144:211rg9/dHIm5gx8ISWIrPTka9ZhuGQT2+LwTdSv+qEMxpASjTnrxU:2c9/um5i8ISpkcxeAF4xpASTxU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2252	2192	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2252	2192	2bcfd6c06e651641fa0b5b5571d7467a.exe	28
PID 2192 wrote to memory of 2252	2192	2bcfd6c06e651641fa0b5b5571d7467a.exe	28
PID 2192 wrote to memory of 2252	2192	2bcfd6c06e651641fa0b5b5571d7467a.exe	28
PID 2192 wrote to memory of 2252	2192	2bcfd6c06e651641fa0b5b5571d7467a.exe	28

C:\Users\Admin\AppData\Local\Temp\2bcfd6c06e651641fa0b5b5571d7467a.exe
"C:\Users\Admin\AppData\Local\Temp\2bcfd6c06e651641fa0b5b5571d7467a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 116
  2⤵
  - Program crash
  PID:2252

memory/2192-0-0x0000000000870000-0x00000000008D0000-memory.dmp

Filesize
384KB

Download