e17e97794c6ec32088b857eb6d16995fc3b1c02fa5416795f65895b97735c854

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 11:11

Target

b49090bb878989a595af03110e0a925a.exe
Size

51KB
MD5

b49090bb878989a595af03110e0a925a
SHA1

ac1674e9409b13ab07e179b758773fc8d8132e0a
SHA256

e17e97794c6ec32088b857eb6d16995fc3b1c02fa5416795f65895b97735c854
SHA512

fef6af925f1ed385ab573e9494812d02d2f1cd9e54caa04d8e0a5ed0f44c0e32f0830640cb21cfc015016587508ea4bc116c22f9227b57f6556097d52b64c4ff
SSDEEP

768:QA/0LLaSldZyI3IhTwRMjRH3SiyAHEt7QXHM14Z4+d4FL7XhE6zXeQIG8e:QA/0LLaSlKZRHn6QNZzd4RtzXe+f

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2492	2944	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2492	2944	b49090bb878989a595af03110e0a925a.exe	28
PID 2944 wrote to memory of 2492	2944	b49090bb878989a595af03110e0a925a.exe	28
PID 2944 wrote to memory of 2492	2944	b49090bb878989a595af03110e0a925a.exe	28
PID 2944 wrote to memory of 2492	2944	b49090bb878989a595af03110e0a925a.exe	28

C:\Users\Admin\AppData\Local\Temp\b49090bb878989a595af03110e0a925a.exe
"C:\Users\Admin\AppData\Local\Temp\b49090bb878989a595af03110e0a925a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 88
  2⤵
  - Program crash
  PID:2492

memory/2944-0-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download