0b38b2e9c302464a18f72d44c2e04c7e16a663355016b72179e8dfdab6a3fdc4

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-02-2024 05:56

Target

88bb8c1832eada0e33c395b7ff548733.exe
Size

738KB
MD5

88bb8c1832eada0e33c395b7ff548733
SHA1

cd9f11d9f06e3a33378ad7749854dce08d522f0d
SHA256

0b38b2e9c302464a18f72d44c2e04c7e16a663355016b72179e8dfdab6a3fdc4
SHA512

7926dc74ca50b6aa85f4e2a3e6742ce361d26d823639a99496b45ec3540c0a44fa325b7d91f6bda33674a7d0093c38fd74523e523faf3065b421627b2a6380e3
SSDEEP

12288:CAwSfxL/2Dc3WDLLmt0LDQewsHj7cLppsC3IrKfdugohbZZfY5NK/w56VEp:HfewsHj7clXtfd6t+5New57

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1936	2380	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1936	2380	88bb8c1832eada0e33c395b7ff548733.exe	28
PID 2380 wrote to memory of 1936	2380	88bb8c1832eada0e33c395b7ff548733.exe	28
PID 2380 wrote to memory of 1936	2380	88bb8c1832eada0e33c395b7ff548733.exe	28
PID 2380 wrote to memory of 1936	2380	88bb8c1832eada0e33c395b7ff548733.exe	28

C:\Users\Admin\AppData\Local\Temp\88bb8c1832eada0e33c395b7ff548733.exe
"C:\Users\Admin\AppData\Local\Temp\88bb8c1832eada0e33c395b7ff548733.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 124
  2⤵
  - Program crash
  PID:1936

memory/2380-0-0x0000000001090000-0x000000000117F000-memory.dmp

Filesize
956KB

Download
memory/2380-1-0x0000000001090000-0x000000000117F000-memory.dmp

Filesize
956KB

Download
memory/2380-2-0x0000000001090000-0x000000000117F000-memory.dmp

Filesize
956KB

Download