a17f2da5e77bb1395592b29fe08079c04a5bb3570dccf697bf4138a5fa9699c7

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 10:29

Target

b479d972a453221460bbb56fcc1065ad.exe
Size

608KB
MD5

b479d972a453221460bbb56fcc1065ad
SHA1

a8124be581091d6faca501423c395fac5412605b
SHA256

a17f2da5e77bb1395592b29fe08079c04a5bb3570dccf697bf4138a5fa9699c7
SHA512

e5042ca3b0643b8e1fb0ae539f3521f485c353cf809b0d4e45638dcf1fd92ae453721ec52a1b860ca1f32739634d477192ebb4ee1ab71b173c797cd73ad845bf
SSDEEP

12288:AQnOndk7TbCMPW5A6X4tbAYkrYJAeZ1sugMG0xt8wGpB5NW1vnPzaG/3KuhJ:AQOdQbC8W5A0YirYhisG0xt8wVvPzZyO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2060	1924	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2060	1924	b479d972a453221460bbb56fcc1065ad.exe	28
PID 1924 wrote to memory of 2060	1924	b479d972a453221460bbb56fcc1065ad.exe	28
PID 1924 wrote to memory of 2060	1924	b479d972a453221460bbb56fcc1065ad.exe	28
PID 1924 wrote to memory of 2060	1924	b479d972a453221460bbb56fcc1065ad.exe	28

C:\Users\Admin\AppData\Local\Temp\b479d972a453221460bbb56fcc1065ad.exe
"C:\Users\Admin\AppData\Local\Temp\b479d972a453221460bbb56fcc1065ad.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 204
  2⤵
  - Program crash
  PID:2060