ac6d5bbf88408590c7c0534540e013faec051791526362c428fcb16dce06adf2

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 10:05

Target

b46e15156512c29975e6aaa5c8dd4c13.exe
Size

64KB
MD5

b46e15156512c29975e6aaa5c8dd4c13
SHA1

8c97b34aa2e49270ab251fc6670fb6fccf89028a
SHA256

ac6d5bbf88408590c7c0534540e013faec051791526362c428fcb16dce06adf2
SHA512

a653bd91facb85b0f5deada3a1bfb1025de141d77fc640fe98950104def848172e2dcee403c7ec74cf1c276f19df8a94cfc44cf271f9abac26842eb3739ee419
SSDEEP

768:QeWF6ydTH+z3AGbm2Si85F6/aA8igsWlc6QDarVNcWl2p/1H5dXdnhaBGHBJ1nVW:9I6y8wWUDFWp8IM2LdsBMu/H1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2036	2804	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2036	2804	b46e15156512c29975e6aaa5c8dd4c13.exe	28
PID 2804 wrote to memory of 2036	2804	b46e15156512c29975e6aaa5c8dd4c13.exe	28
PID 2804 wrote to memory of 2036	2804	b46e15156512c29975e6aaa5c8dd4c13.exe	28
PID 2804 wrote to memory of 2036	2804	b46e15156512c29975e6aaa5c8dd4c13.exe	28

C:\Users\Admin\AppData\Local\Temp\b46e15156512c29975e6aaa5c8dd4c13.exe
"C:\Users\Admin\AppData\Local\Temp\b46e15156512c29975e6aaa5c8dd4c13.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 140
  2⤵
  - Program crash
  PID:2036

memory/2804-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2804-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download