b8d98e6e1fc645e7602badc5f1389cace0954e5c5d4a3d12266f4a6c28bd7d6a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 00:41

Target

3f74ea00c5d206e8b62d98b6b5613d05.exe
Size

44KB
MD5

3f74ea00c5d206e8b62d98b6b5613d05
SHA1

4559cc03ff7108e286264758959c4a221bef8788
SHA256

b8d98e6e1fc645e7602badc5f1389cace0954e5c5d4a3d12266f4a6c28bd7d6a
SHA512

faf882ca3ee8d7c0a05ec7f913bd12a529053096d48a52d14d171ce76427b31bbdb8c9bb67e28ae8a2a57270bb4e52ee6811c18b9892908ca54201d7aae66f69
SSDEEP

768:4Iaie4i6r4pcDoivYZs2TSJ6CIeiA+RT5wgevPEIk13s8yPuhm4oF+o:cxWXxsICxyPFwo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1736	2232	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1736	2232	3f74ea00c5d206e8b62d98b6b5613d05.exe	28
PID 2232 wrote to memory of 1736	2232	3f74ea00c5d206e8b62d98b6b5613d05.exe	28
PID 2232 wrote to memory of 1736	2232	3f74ea00c5d206e8b62d98b6b5613d05.exe	28
PID 2232 wrote to memory of 1736	2232	3f74ea00c5d206e8b62d98b6b5613d05.exe	28

C:\Users\Admin\AppData\Local\Temp\3f74ea00c5d206e8b62d98b6b5613d05.exe
"C:\Users\Admin\AppData\Local\Temp\3f74ea00c5d206e8b62d98b6b5613d05.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 88
  2⤵
  - Program crash
  PID:1736