0b84ac3955a80cf52a923ca0cf14b32b980591a82d6491aa0a4d4859639b1dbd

Analysis

max time kernel
121s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 02:48

Target

3bb18faf6310c4ae92b62abfb3eee371.exe
Size

1.0MB
MD5

3bb18faf6310c4ae92b62abfb3eee371
SHA1

7e6342ae5faa01f660a9650e0394e2189678720d
SHA256

0b84ac3955a80cf52a923ca0cf14b32b980591a82d6491aa0a4d4859639b1dbd
SHA512

eda95539c3bfc791e87e1c365cada57c1ec84e6c258c4dae6f041f9d348673715e3b025fd55acf2617ab3eb7dd5f9f699e05063498edf257d4416ff1f33edccb
SSDEEP

12288:RAHn2JK+HemNsqI3etnBHYPpAkApyRV3jRfP4S5LH28U3mcQuKXQoggdnyfXXJzo:RAHnh+eWsN3skA4RV1Hom2KXMmCRcV5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1304	1816	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 1304	1816	3bb18faf6310c4ae92b62abfb3eee371.exe	28
PID 1816 wrote to memory of 1304	1816	3bb18faf6310c4ae92b62abfb3eee371.exe	28
PID 1816 wrote to memory of 1304	1816	3bb18faf6310c4ae92b62abfb3eee371.exe	28
PID 1816 wrote to memory of 1304	1816	3bb18faf6310c4ae92b62abfb3eee371.exe	28

C:\Users\Admin\AppData\Local\Temp\3bb18faf6310c4ae92b62abfb3eee371.exe
"C:\Users\Admin\AppData\Local\Temp\3bb18faf6310c4ae92b62abfb3eee371.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 36
  2⤵
  - Program crash
  PID:1304