5bff88706a4150eb192cccb8eb0dde255feddf046576eea2310cfb8ffd7d4693

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 08:25

Target

b4401401166f1da4d06dc4616129e365.exe
Size

1.4MB
MD5

b4401401166f1da4d06dc4616129e365
SHA1

92d05a2510f75d4dd379c6cba3178d80aa85e1d1
SHA256

5bff88706a4150eb192cccb8eb0dde255feddf046576eea2310cfb8ffd7d4693
SHA512

aa9d8eac628f77fe6bb1e1975b02fb11235233c25d469f84b6a8b6167b518b700183c197f0ced6f70555021017f90844b5964fce3a497db96f703e3d74f3292d
SSDEEP

24576:xYaetv2N8npTWbeqCxdUdxk4tmvi/WYLlZjNltYk87tLxjAmrlEm0HZoqrir4Wtt:xitvsneqzks/JhIk87nBoHLwRPB+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3008	1764	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 3008	1764	b4401401166f1da4d06dc4616129e365.exe	28
PID 1764 wrote to memory of 3008	1764	b4401401166f1da4d06dc4616129e365.exe	28
PID 1764 wrote to memory of 3008	1764	b4401401166f1da4d06dc4616129e365.exe	28
PID 1764 wrote to memory of 3008	1764	b4401401166f1da4d06dc4616129e365.exe	28

C:\Users\Admin\AppData\Local\Temp\b4401401166f1da4d06dc4616129e365.exe
"C:\Users\Admin\AppData\Local\Temp\b4401401166f1da4d06dc4616129e365.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 36
  2⤵
  - Program crash
  PID:3008

memory/1764-0-0x0000000000400000-0x000000000055E200-memory.dmp

Filesize
1.4MB

Download