8a7198752ccbd4d58f69fcfe7be662a38e70aedb1af009c7d731d9d7dc26bc9c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 08:10

Target

b438d01b1acaf67a0b8f4d551c9ccac2.exe
Size

123KB
MD5

b438d01b1acaf67a0b8f4d551c9ccac2
SHA1

61b427464ba00f795840450d2897ae1fda65a0a4
SHA256

8a7198752ccbd4d58f69fcfe7be662a38e70aedb1af009c7d731d9d7dc26bc9c
SHA512

f656a11c78affd51b859e9a8f9d11eb9983f3971c89d5719396f35a57ef3d05b273aa41d03d28fb6ba5200667b8e938d855140d1e51bb0fe5f5ef0e2928e2d31
SSDEEP

3072:fRtWIJ0IyRWEqv5F3x/3XXcP7+0nN0RoOy4hmsy:fRtLeWEqv5F3x/3XG7DnNXOy48sy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2316	2892	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2316	2892	b438d01b1acaf67a0b8f4d551c9ccac2.exe	28
PID 2892 wrote to memory of 2316	2892	b438d01b1acaf67a0b8f4d551c9ccac2.exe	28
PID 2892 wrote to memory of 2316	2892	b438d01b1acaf67a0b8f4d551c9ccac2.exe	28
PID 2892 wrote to memory of 2316	2892	b438d01b1acaf67a0b8f4d551c9ccac2.exe	28

C:\Users\Admin\AppData\Local\Temp\b438d01b1acaf67a0b8f4d551c9ccac2.exe
"C:\Users\Admin\AppData\Local\Temp\b438d01b1acaf67a0b8f4d551c9ccac2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 44
  2⤵
  - Program crash
  PID:2316

memory/2892-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download