121691bdb18df28a2953d8c80361cc2a5ea154ec2762bfc48c1eee9dd5abf03e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 19:07

Target

b57392617f0250e741b5b95b941fb4ee.exe
Size

7KB
MD5

b57392617f0250e741b5b95b941fb4ee
SHA1

8b906957d71b89df4429a11018a8fc4f8cab7f25
SHA256

121691bdb18df28a2953d8c80361cc2a5ea154ec2762bfc48c1eee9dd5abf03e
SHA512

999baf32a567e1cac2de9589722a1280f80ea131c721f9d0a44c10f9c1d5f387d7a25147be996ad78d98617f575e953a99e5b2eaaea6837c04ec28f642a144d5
SSDEEP

96:jbL8LYNagEXdwJey2YfBq/YbKO3cC1FOZNkvxHxruLUYA7hzUGj18SkRO1fy:vLTK+Qy2YfBiUxFOZCvx3QGZLkRWa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2396	856	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 2396	856	b57392617f0250e741b5b95b941fb4ee.exe	28
PID 856 wrote to memory of 2396	856	b57392617f0250e741b5b95b941fb4ee.exe	28
PID 856 wrote to memory of 2396	856	b57392617f0250e741b5b95b941fb4ee.exe	28
PID 856 wrote to memory of 2396	856	b57392617f0250e741b5b95b941fb4ee.exe	28

C:\Users\Admin\AppData\Local\Temp\b57392617f0250e741b5b95b941fb4ee.exe
"C:\Users\Admin\AppData\Local\Temp\b57392617f0250e741b5b95b941fb4ee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 36
  2⤵
  - Program crash
  PID:2396

memory/856-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download