bfb685d4688fc0b26d5c0376135557bd2aa3b1e29762f9f45f61caa197cc6273

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 01:55

Target

44fc5d5063f01c96adb07a4cdbaf58e8.exe
Size

276KB
MD5

44fc5d5063f01c96adb07a4cdbaf58e8
SHA1

a827608f5d670d3356bcf2ab2b881d131d77ea26
SHA256

bfb685d4688fc0b26d5c0376135557bd2aa3b1e29762f9f45f61caa197cc6273
SHA512

884a9f9095c0828d2aed8cda0eae57ee70829212404553ca3d3d260f274346141a96c0b1a4bcdf54f5fdbadcd350ff067b3d06b4f8f417c85d47d22f9d66322c
SSDEEP

6144:15AtMm2r8WYKHGi0vBDx3tIdY4o8SPfT6fWBuxXsU57E7U:bcMm2rcKH50vxx3KtoBfOuykU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2280	2844	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2280	2844	44fc5d5063f01c96adb07a4cdbaf58e8.exe	28
PID 2844 wrote to memory of 2280	2844	44fc5d5063f01c96adb07a4cdbaf58e8.exe	28
PID 2844 wrote to memory of 2280	2844	44fc5d5063f01c96adb07a4cdbaf58e8.exe	28
PID 2844 wrote to memory of 2280	2844	44fc5d5063f01c96adb07a4cdbaf58e8.exe	28

C:\Users\Admin\AppData\Local\Temp\44fc5d5063f01c96adb07a4cdbaf58e8.exe
"C:\Users\Admin\AppData\Local\Temp\44fc5d5063f01c96adb07a4cdbaf58e8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 108
  2⤵
  - Program crash
  PID:2280