fb7fd2cc6b2a6072bc92e8e5f3006f90c82e37f84637bcea51d4e6bf1c9f9b50

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03-01-2024 20:50

Target

3f0b8b89b0b92b43a45efad471a98a30.exe
Size

11KB
MD5

3f0b8b89b0b92b43a45efad471a98a30
SHA1

f7694afb48c99488b93100626ac5171f0d4ccbed
SHA256

fb7fd2cc6b2a6072bc92e8e5f3006f90c82e37f84637bcea51d4e6bf1c9f9b50
SHA512

3a77382ffe4a39636159993b6b41ff526e9fc49cfc2cea113c3a50923c2c70e1bc0fe271e8b14d5d82ad3d703469236c8b76afd3fe7068c47c8587654f119122
SSDEEP

192:evVAwz5ZhY8L/TZRqkdGO3Z8FTZDjxGUHqT93KN920kAH:aAwJYWl/3OXCTlY920k

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2916	2904	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2916	2904	3f0b8b89b0b92b43a45efad471a98a30.exe	16
PID 2904 wrote to memory of 2916	2904	3f0b8b89b0b92b43a45efad471a98a30.exe	16
PID 2904 wrote to memory of 2916	2904	3f0b8b89b0b92b43a45efad471a98a30.exe	16
PID 2904 wrote to memory of 2916	2904	3f0b8b89b0b92b43a45efad471a98a30.exe	16

C:\Users\Admin\AppData\Local\Temp\3f0b8b89b0b92b43a45efad471a98a30.exe
"C:\Users\Admin\AppData\Local\Temp\3f0b8b89b0b92b43a45efad471a98a30.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 88
  2⤵
  - Program crash
  PID:2916