b429fe7bb3adaee937d0459c36351a9c37dfe2cc69c76adbca67a04af3554ad8

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 07:29

Target

b423f320d54f9677c8a050e72cb53e58.exe
Size

6KB
MD5

b423f320d54f9677c8a050e72cb53e58
SHA1

48db7f9304f05797f745a82141fa5978f8b5fb51
SHA256

b429fe7bb3adaee937d0459c36351a9c37dfe2cc69c76adbca67a04af3554ad8
SHA512

e7bf2677f004ee1f5f919e0ccac6ae955edcbafe5119174083669b44d6d5fc813bf379b92f439d20814d74a27f791f939beae3350ebc39b138cadfbcf2941962
SSDEEP

96:jz5tjBFyllLNt8w+vrpwCsJVUTOzMTQr6MrvGwh4p:fPjnyx/8BJsPUTOzMTkhrewCp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2372	1092	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 2372	1092	b423f320d54f9677c8a050e72cb53e58.exe	28
PID 1092 wrote to memory of 2372	1092	b423f320d54f9677c8a050e72cb53e58.exe	28
PID 1092 wrote to memory of 2372	1092	b423f320d54f9677c8a050e72cb53e58.exe	28
PID 1092 wrote to memory of 2372	1092	b423f320d54f9677c8a050e72cb53e58.exe	28

C:\Users\Admin\AppData\Local\Temp\b423f320d54f9677c8a050e72cb53e58.exe
"C:\Users\Admin\AppData\Local\Temp\b423f320d54f9677c8a050e72cb53e58.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 140
  2⤵
  - Program crash
  PID:2372

memory/1092-0-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1092-1-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download