302562bb2892dad1ab0259fd281efb369d6fb6ed2ad11be72eec36c81b8acd15

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 21:40

Target

51b049a7cff9d935826fa7d9c135e863.exe
Size

430KB
MD5

51b049a7cff9d935826fa7d9c135e863
SHA1

bc12ecfb946d478621350880245791ad89d521aa
SHA256

302562bb2892dad1ab0259fd281efb369d6fb6ed2ad11be72eec36c81b8acd15
SHA512

1bff7b189fcf11e7bcc3efa8d3a5b71329f6aa1b53f6839198053c2c12d5c19df27b55a2c1e8d2759339f6d5d64d52a95831d286c3377860ce2296bac8330e3c
SSDEEP

6144:Ulsy4TNbEm1B1zzqaCh9Ju/2x+vw0b8ajNglS2+gUXpP9YC4r:UdwNIm1B1zzqrh9Jf+btwSfgUnBI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2176	1780	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2176	1780	51b049a7cff9d935826fa7d9c135e863.exe	15
PID 1780 wrote to memory of 2176	1780	51b049a7cff9d935826fa7d9c135e863.exe	15
PID 1780 wrote to memory of 2176	1780	51b049a7cff9d935826fa7d9c135e863.exe	15
PID 1780 wrote to memory of 2176	1780	51b049a7cff9d935826fa7d9c135e863.exe	15

C:\Users\Admin\AppData\Local\Temp\51b049a7cff9d935826fa7d9c135e863.exe
"C:\Users\Admin\AppData\Local\Temp\51b049a7cff9d935826fa7d9c135e863.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 116
  2⤵
  - Program crash
  PID:2176

memory/1780-0-0x00000000010B0000-0x0000000001120000-memory.dmp

Filesize
448KB

Download