600cdaae21f8ec9297a49634787af849aa78951e8804ec5a25d541279b0c4a08

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15-01-2024 01:03

Target

5bb9859f367745bc3fa24a568a050141.exe
Size

1.5MB
MD5

5bb9859f367745bc3fa24a568a050141
SHA1

477462059cc40812efda11bcbbc8c23ba86e6634
SHA256

600cdaae21f8ec9297a49634787af849aa78951e8804ec5a25d541279b0c4a08
SHA512

0a3660018228917eafea4035dff6d587d0f1c51c7fb2ad34653d32bfac0452d36bd2b60371d262ca5d5a5804d3c0bd0e486905c97772edd3b0cf95fb7bc6c14f
SSDEEP

24576:WvdYAcUR0mSQOZJcDshAIQmQIIxVB9iLNUHUpHHPDrlkyKGl:m1cHOOc6AYYxh4WaPDrlz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	1248	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 1728	1248	5bb9859f367745bc3fa24a568a050141.exe	28
PID 1248 wrote to memory of 1728	1248	5bb9859f367745bc3fa24a568a050141.exe	28
PID 1248 wrote to memory of 1728	1248	5bb9859f367745bc3fa24a568a050141.exe	28
PID 1248 wrote to memory of 1728	1248	5bb9859f367745bc3fa24a568a050141.exe	28

C:\Users\Admin\AppData\Local\Temp\5bb9859f367745bc3fa24a568a050141.exe
"C:\Users\Admin\AppData\Local\Temp\5bb9859f367745bc3fa24a568a050141.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 200
  2⤵
  - Program crash
  PID:1728

memory/1248-0-0x0000000000CF0000-0x0000000000E7E000-memory.dmp

Filesize
1.6MB

Download