3aae6542898489155df8ad79e642592116b03749c6971e4450c34566975ce89d

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 09:37

Target

b460c19a49afc6ff621f5f9fd1c8fe81.exe
Size

30KB
MD5

b460c19a49afc6ff621f5f9fd1c8fe81
SHA1

1d0d7206eef4b30f60c9dcb7a74ed5077be0fe37
SHA256

3aae6542898489155df8ad79e642592116b03749c6971e4450c34566975ce89d
SHA512

179f21208c08c182e9659b4ebb72d072f8022d6e10ab51c42fde3f35d8fd9834609e5f27dacb6b66121587419e203869281ffa89342557ed08386ce7369c3aaa
SSDEEP

384:2zJY5z/rLAo2SKb9nmmx6u6iOEuOPlyHDB2V/gp0ix70POMmxdA4o1kjW+//cW:OY5bAocbBD6I6YFi50GMGdfo1kjP31

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	2408	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 1728	2408	b460c19a49afc6ff621f5f9fd1c8fe81.exe	28
PID 2408 wrote to memory of 1728	2408	b460c19a49afc6ff621f5f9fd1c8fe81.exe	28
PID 2408 wrote to memory of 1728	2408	b460c19a49afc6ff621f5f9fd1c8fe81.exe	28
PID 2408 wrote to memory of 1728	2408	b460c19a49afc6ff621f5f9fd1c8fe81.exe	28

C:\Users\Admin\AppData\Local\Temp\b460c19a49afc6ff621f5f9fd1c8fe81.exe
"C:\Users\Admin\AppData\Local\Temp\b460c19a49afc6ff621f5f9fd1c8fe81.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 36
  2⤵
  - Program crash
  PID:1728

memory/2408-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download