bbd37be845b5e726430393ce59e2ba7f26d13a1818c92421e884d9f29df1e059

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17/01/2024, 20:01

Target

637a3ff24fa58bd3769082084510c6e0.exe
Size

23KB
MD5

637a3ff24fa58bd3769082084510c6e0
SHA1

d258a028c057e2d7bd3ce8efce4966ddea08c70b
SHA256

bbd37be845b5e726430393ce59e2ba7f26d13a1818c92421e884d9f29df1e059
SHA512

bb4f31d3bd1c6811e49c700b7001a10bce1ae19a1993e6797d30e9dabe13b54851d97643a0fd2f018500687bfb3a96f21eae1583b8f4e5cb26ec69e02b6cc12b
SSDEEP

384:4hdGAt6mjjXEuo6+sljyJQXHxNkZ/fB2ThxucSqn2FJGNviX1ujm5f9o1:uZ6wXesMCxgxIxbBn261Qujm51o

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2988	2976	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2988	2976	637a3ff24fa58bd3769082084510c6e0.exe	28
PID 2976 wrote to memory of 2988	2976	637a3ff24fa58bd3769082084510c6e0.exe	28
PID 2976 wrote to memory of 2988	2976	637a3ff24fa58bd3769082084510c6e0.exe	28
PID 2976 wrote to memory of 2988	2976	637a3ff24fa58bd3769082084510c6e0.exe	28

C:\Users\Admin\AppData\Local\Temp\637a3ff24fa58bd3769082084510c6e0.exe
"C:\Users\Admin\AppData\Local\Temp\637a3ff24fa58bd3769082084510c6e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 116
  2⤵
  - Program crash
  PID:2988