a4b44b4021d168b76e778b4d5b0844e70219b250242ad904415f11ec7ffdb932

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 04:59

Target

3bf36951e60ebdeaab4a88fb6719eaea.exe
Size

28KB
MD5

3bf36951e60ebdeaab4a88fb6719eaea
SHA1

98c5925d65083eae9b2372f8f5cf2a13369e2259
SHA256

a4b44b4021d168b76e778b4d5b0844e70219b250242ad904415f11ec7ffdb932
SHA512

c0b644ab9929906dabf041297418d247bfd4aed2afd1e542fe8e76cfd418fd555423d6be176bd291540f99314b2eb14c517c92f78c83faa76f93595088f44fd6
SSDEEP

768:ut4NHyTUuoz0rvlBlOrKgsPPaZlQLcyxkz5oosl35z4N:ueNHS/rvPlOWg1Qvkz5WbW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1720	1536	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 1720	1536	3bf36951e60ebdeaab4a88fb6719eaea.exe	28
PID 1536 wrote to memory of 1720	1536	3bf36951e60ebdeaab4a88fb6719eaea.exe	28
PID 1536 wrote to memory of 1720	1536	3bf36951e60ebdeaab4a88fb6719eaea.exe	28
PID 1536 wrote to memory of 1720	1536	3bf36951e60ebdeaab4a88fb6719eaea.exe	28

C:\Users\Admin\AppData\Local\Temp\3bf36951e60ebdeaab4a88fb6719eaea.exe
"C:\Users\Admin\AppData\Local\Temp\3bf36951e60ebdeaab4a88fb6719eaea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 88
  2⤵
  - Program crash
  PID:1720

memory/1536-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download