1775fbdaf59c0b40927cb42d4852ba1b4c50ac92220bdc7debb6f8dde7395913

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 20:28

Target

b596c1ee9c3664098054d9f194bc37b5.exe
Size

155KB
MD5

b596c1ee9c3664098054d9f194bc37b5
SHA1

065cd28e3f065e30caeddf64c6ca03da26ce6341
SHA256

1775fbdaf59c0b40927cb42d4852ba1b4c50ac92220bdc7debb6f8dde7395913
SHA512

216cec22c1b5443d9375bfbebe9d8675a4b7e8c45494d1d37f441ed887dcfcdf73ebc8b7b70be6e6c6540374f7568e3322483738a7b8f56b8743ca86dd6c4f3f
SSDEEP

3072:lbunpa6RRAwGABgkLJbfFp5sE4JshwwBuPTlG+LzsYQTMk+MYKfrs7y5n:Ipa6LHGABvJbCE4JYLOTo+XwMkFfOy5n

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
532	2956	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 532	2956	b596c1ee9c3664098054d9f194bc37b5.exe	28
PID 2956 wrote to memory of 532	2956	b596c1ee9c3664098054d9f194bc37b5.exe	28
PID 2956 wrote to memory of 532	2956	b596c1ee9c3664098054d9f194bc37b5.exe	28
PID 2956 wrote to memory of 532	2956	b596c1ee9c3664098054d9f194bc37b5.exe	28

C:\Users\Admin\AppData\Local\Temp\b596c1ee9c3664098054d9f194bc37b5.exe
"C:\Users\Admin\AppData\Local\Temp\b596c1ee9c3664098054d9f194bc37b5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 36
  2⤵
  - Program crash
  PID:532

memory/2956-0-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2956-1-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download