bba17eb49a003e069a23636380538dc90d2830e83cfb9414d01dd51a4982bb70

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 20:32

Target

3f0330e2986a4b265566498cbccce170.exe
Size

90KB
MD5

3f0330e2986a4b265566498cbccce170
SHA1

2a5d3e2abea66e977eb74381e4c83223df8e7249
SHA256

bba17eb49a003e069a23636380538dc90d2830e83cfb9414d01dd51a4982bb70
SHA512

04a8cfc503f7ebdb8be55af81224db0065a7d519feaa9e4e6284a0f2c3b29bb8238639bdba21c7e8fc68c80e6009f04e694aee081bdbaa0a06608d445d5a5c38
SSDEEP

1536:lKrlljc/mZmAeEbmNQpMVq0K95ESGBg5uFS5V+r017qBuxA4yQbXHl1OVY:lKdIumANbkQKq005/5rTsYCQbXHP2Y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1988	2256	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 1988	2256	3f0330e2986a4b265566498cbccce170.exe	28
PID 2256 wrote to memory of 1988	2256	3f0330e2986a4b265566498cbccce170.exe	28
PID 2256 wrote to memory of 1988	2256	3f0330e2986a4b265566498cbccce170.exe	28
PID 2256 wrote to memory of 1988	2256	3f0330e2986a4b265566498cbccce170.exe	28

C:\Users\Admin\AppData\Local\Temp\3f0330e2986a4b265566498cbccce170.exe
"C:\Users\Admin\AppData\Local\Temp\3f0330e2986a4b265566498cbccce170.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 36
  2⤵
  - Program crash
  PID:1988

memory/2256-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download