879b9977e0f396b8b3f0bf3f2e2ff22c0d26185a3d2096b370b32e52bb8644fe

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 12:54

Target

b4be54bef4bd4ad3851f16237232e38a.exe
Size

240KB
MD5

b4be54bef4bd4ad3851f16237232e38a
SHA1

122137a3346848f70409fac01e26cb3171074a35
SHA256

879b9977e0f396b8b3f0bf3f2e2ff22c0d26185a3d2096b370b32e52bb8644fe
SHA512

8c4d4fc491574529872bce7a722673f857b90e27a700f63684a0259cb51ba9f35a6e03e674c252b92994d9c5f47bec7e2c2fa01de0ee5e52e4cbe4a9a0629420
SSDEEP

6144:LoDHy5sFlJgSqyBcjXRyCDnywWRDbQ9cxo8pX:LwSmFlGSqyBOXRVDnywYDE6x5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2472	1900	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2472	1900	b4be54bef4bd4ad3851f16237232e38a.exe	29
PID 1900 wrote to memory of 2472	1900	b4be54bef4bd4ad3851f16237232e38a.exe	29
PID 1900 wrote to memory of 2472	1900	b4be54bef4bd4ad3851f16237232e38a.exe	29
PID 1900 wrote to memory of 2472	1900	b4be54bef4bd4ad3851f16237232e38a.exe	29

C:\Users\Admin\AppData\Local\Temp\b4be54bef4bd4ad3851f16237232e38a.exe
"C:\Users\Admin\AppData\Local\Temp\b4be54bef4bd4ad3851f16237232e38a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 88
  2⤵
  - Program crash
  PID:2472

memory/1900-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download