3a61ca7023aa836f4c4df3a39ec0e2640e2b12ad50e0b36067706ebf08eab4c1

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 14:10

Target

b4e5b5367a96448c714dcad6a610415e.exe
Size

57KB
MD5

b4e5b5367a96448c714dcad6a610415e
SHA1

e60bf1cfec1acde2743b5d5e9c8405ce45870b24
SHA256

3a61ca7023aa836f4c4df3a39ec0e2640e2b12ad50e0b36067706ebf08eab4c1
SHA512

327dd97b24b5cae53be53d992721f38109fd4d430ef655b36eb993938d2add531ccba6665e7f7795a8bde6fec069279ca7dc73c5a1f7277bf45e90842a993b90
SSDEEP

1536:PWZiUaU8FvK1a/vhG88TogilRFfuddvUmPrZzO7wLsv:PW2USKo/vhaToginFfuddxNzDs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2360	2516	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2360	2516	b4e5b5367a96448c714dcad6a610415e.exe	28
PID 2516 wrote to memory of 2360	2516	b4e5b5367a96448c714dcad6a610415e.exe	28
PID 2516 wrote to memory of 2360	2516	b4e5b5367a96448c714dcad6a610415e.exe	28
PID 2516 wrote to memory of 2360	2516	b4e5b5367a96448c714dcad6a610415e.exe	28

C:\Users\Admin\AppData\Local\Temp\b4e5b5367a96448c714dcad6a610415e.exe
"C:\Users\Admin\AppData\Local\Temp\b4e5b5367a96448c714dcad6a610415e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 120
  2⤵
  - Program crash
  PID:2360

memory/2516-0-0x0000000000220000-0x0000000000225000-memory.dmp

Filesize
20KB

Download