34821fdb57927fb98a992b655da48b3ea3eb953530475c884eea897d5848a6a5

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 22:11

Target

b5c8812048747b3f693aa096ad38297d.exe
Size

59KB
MD5

b5c8812048747b3f693aa096ad38297d
SHA1

0101c713a43457e0cf2c9a6824d73b6f0e63f033
SHA256

34821fdb57927fb98a992b655da48b3ea3eb953530475c884eea897d5848a6a5
SHA512

8874b3cb929e29486dfc1d9669d64547e6d7ee8ad693cd80cd16f205f43defbabc1e41ede79812370d42ced1ab87f77af3f5a12deb3c6e8e7655d3b15c38d60b
SSDEEP

1536:RSe9xwrq5AxK/eYT5nby5r4lqQAgnexxk/3nNutCUS4Ikoz3dY:RSeArq5AKeA5ng42ghusUSjkoz3dY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1800	1464	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1800	1464	b5c8812048747b3f693aa096ad38297d.exe	28
PID 1464 wrote to memory of 1800	1464	b5c8812048747b3f693aa096ad38297d.exe	28
PID 1464 wrote to memory of 1800	1464	b5c8812048747b3f693aa096ad38297d.exe	28
PID 1464 wrote to memory of 1800	1464	b5c8812048747b3f693aa096ad38297d.exe	28

C:\Users\Admin\AppData\Local\Temp\b5c8812048747b3f693aa096ad38297d.exe
"C:\Users\Admin\AppData\Local\Temp\b5c8812048747b3f693aa096ad38297d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 36
  2⤵
  - Program crash
  PID:1800

memory/1464-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1464-1-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download