3bc1c9d6251acecb9db59ddc8edd79bf9d5c046013ef29da7263a25e56a89c3b

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/01/2024, 21:32

Target

3bc1c9d6251acecb9db59ddc8edd79bf9d5c046013ef29da7263a25e56a89c3b.exe
Size

5KB
MD5

06ced1dc43c1e3dba437f7b2c16ab896
SHA1

ec086f6bf26c30368ebd0edeec884cbca4cf9c4c
SHA256

3bc1c9d6251acecb9db59ddc8edd79bf9d5c046013ef29da7263a25e56a89c3b
SHA512

c053b17be3978f4b9a5e0e8175df942cda62929342fc2cc7b8b8c53f20583775de1214555b89e782fb812b63436b46d2de3a1ac5bbf0552018994d28a57f5ff5
SSDEEP

48:SrlXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7tRRuqSxp:wWLkFfNnOKYloIQ2pm2pbYSvxE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2832	2652	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2832	2652	3bc1c9d6251acecb9db59ddc8edd79bf9d5c046013ef29da7263a25e56a89c3b.exe	28
PID 2652 wrote to memory of 2832	2652	3bc1c9d6251acecb9db59ddc8edd79bf9d5c046013ef29da7263a25e56a89c3b.exe	28
PID 2652 wrote to memory of 2832	2652	3bc1c9d6251acecb9db59ddc8edd79bf9d5c046013ef29da7263a25e56a89c3b.exe	28
PID 2652 wrote to memory of 2832	2652	3bc1c9d6251acecb9db59ddc8edd79bf9d5c046013ef29da7263a25e56a89c3b.exe	28

C:\Users\Admin\AppData\Local\Temp\3bc1c9d6251acecb9db59ddc8edd79bf9d5c046013ef29da7263a25e56a89c3b.exe
"C:\Users\Admin\AppData\Local\Temp\3bc1c9d6251acecb9db59ddc8edd79bf9d5c046013ef29da7263a25e56a89c3b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 48
  2⤵
  - Program crash
  PID:2832