b7c8b1ec38546a2f51692216c75d1c26c80f3423f3dd335ac5ae441ffd4e22c3

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27-01-2024 00:32

Target

b7c8b1ec38546a2f51692216c75d1c26c80f3423f3dd335ac5ae441ffd4e22c3.exe
Size

5KB
MD5

027ece5bc35477b539d905f83fa993db
SHA1

839e0840cc5445dd5d6db03f614b2ae10dbdb477
SHA256

b7c8b1ec38546a2f51692216c75d1c26c80f3423f3dd335ac5ae441ffd4e22c3
SHA512

e40f22c2ca2d90e7092a60b04ab9950025c5f4f5d876bf7d94dc4cb5e8fb455728def99a3523fae278c1513545d1c47653563535d5f71855ca2340623d93861a
SSDEEP

48:SnlXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7tyRuqSxp:EWLkFfNnOKYloIQ2pm2pbYSOxE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1640	1632	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1640	1632	b7c8b1ec38546a2f51692216c75d1c26c80f3423f3dd335ac5ae441ffd4e22c3.exe	28
PID 1632 wrote to memory of 1640	1632	b7c8b1ec38546a2f51692216c75d1c26c80f3423f3dd335ac5ae441ffd4e22c3.exe	28
PID 1632 wrote to memory of 1640	1632	b7c8b1ec38546a2f51692216c75d1c26c80f3423f3dd335ac5ae441ffd4e22c3.exe	28
PID 1632 wrote to memory of 1640	1632	b7c8b1ec38546a2f51692216c75d1c26c80f3423f3dd335ac5ae441ffd4e22c3.exe	28

C:\Users\Admin\AppData\Local\Temp\b7c8b1ec38546a2f51692216c75d1c26c80f3423f3dd335ac5ae441ffd4e22c3.exe
"C:\Users\Admin\AppData\Local\Temp\b7c8b1ec38546a2f51692216c75d1c26c80f3423f3dd335ac5ae441ffd4e22c3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 48
  2⤵
  - Program crash
  PID:1640