9c786be12025e81e44e9fc8d1de3e41b362631697f807d22a3a6a3a2b402f62a

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 13:26

Target

b4ce15656e25caf9eb3d6360d791acbf.exe
Size

90KB
MD5

b4ce15656e25caf9eb3d6360d791acbf
SHA1

9d88c0668335f8c63594952b1f87ef4515a6b7fc
SHA256

9c786be12025e81e44e9fc8d1de3e41b362631697f807d22a3a6a3a2b402f62a
SHA512

9fc98365faff40c4f2c6cacbf0f3db21eb7367e962354f35320ad2b68447381cde41dec6f2be749ac1593771f5da15f8bceedcf0c493c86d88431b9d4fdb10eb
SSDEEP

1536:jVP1HwdyNPl9K10QIFIdmEhS8p79MzLO/siTUCpKem6Y7TArsjGG+x:JdQdy39KGQB5/sMUam6YEx3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3040	2644	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 3040	2644	b4ce15656e25caf9eb3d6360d791acbf.exe	28
PID 2644 wrote to memory of 3040	2644	b4ce15656e25caf9eb3d6360d791acbf.exe	28
PID 2644 wrote to memory of 3040	2644	b4ce15656e25caf9eb3d6360d791acbf.exe	28
PID 2644 wrote to memory of 3040	2644	b4ce15656e25caf9eb3d6360d791acbf.exe	28

C:\Users\Admin\AppData\Local\Temp\b4ce15656e25caf9eb3d6360d791acbf.exe
"C:\Users\Admin\AppData\Local\Temp\b4ce15656e25caf9eb3d6360d791acbf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 100
  2⤵
  - Program crash
  PID:3040

memory/2644-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2644-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2644-2-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2644-3-0x0000000000220000-0x0000000000226000-memory.dmp

Filesize
24KB

Download
memory/2644-4-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download