79583f9d352f9b43f5cdff17afbcc82f61ad26182aad60ef5e9c4218a4369f3a

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 08:51

Target

b44be1f9200b01d39f08fa70b104bbbf.exe
Size

121KB
MD5

b44be1f9200b01d39f08fa70b104bbbf
SHA1

a865822b7f8b32759cd88b668575c006806509bb
SHA256

79583f9d352f9b43f5cdff17afbcc82f61ad26182aad60ef5e9c4218a4369f3a
SHA512

068c11caf098bf31a7b8e4834e0fafd6f6bd74cde0eba300fae282324c4a6ef5854ca8748358e3ae5eec71dff640e9195b2c7deacba809aefa992d7faf3d6701
SSDEEP

3072:PBF9HogaY8Z31Af67RXRoDA/9WVYbVo9jQpjHc04IFb7Af6R:JFSCm1E67roDVVYho90c09Fb7E6R

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2372	2292	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2372	2292	b44be1f9200b01d39f08fa70b104bbbf.exe	28
PID 2292 wrote to memory of 2372	2292	b44be1f9200b01d39f08fa70b104bbbf.exe	28
PID 2292 wrote to memory of 2372	2292	b44be1f9200b01d39f08fa70b104bbbf.exe	28
PID 2292 wrote to memory of 2372	2292	b44be1f9200b01d39f08fa70b104bbbf.exe	28

C:\Users\Admin\AppData\Local\Temp\b44be1f9200b01d39f08fa70b104bbbf.exe
"C:\Users\Admin\AppData\Local\Temp\b44be1f9200b01d39f08fa70b104bbbf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 36
  2⤵
  - Program crash
  PID:2372

memory/2292-0-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2292-1-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download