7906e24c312fdafed2621d9ed6b522550c536d86a1c5a6db18b2f8777833a5f6

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 20:07

Target

b58e0902b88405efe1ef9f61f026fd0a.exe
Size

195KB
MD5

b58e0902b88405efe1ef9f61f026fd0a
SHA1

3d416f8b2bb679679a9a3fa99687f862aded75d7
SHA256

7906e24c312fdafed2621d9ed6b522550c536d86a1c5a6db18b2f8777833a5f6
SHA512

ae56b3f233393db6dcfee36df20c101c6256c052d06f9949e51d472ccc61c720a1965bad4f650e2499ada3b22a3ea9823afbbc46496ca906f9422d5461e916d3
SSDEEP

3072:l0DWxOXZnGMCeiMIrnC1swyCeYuNVgJDnO7JPbFpQqlfsCU2YOQE1bAWymOPlWmj:MqORrn1NLuM1nO7VF2qC0CVNY4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2620	3040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2620	3040	b58e0902b88405efe1ef9f61f026fd0a.exe	29
PID 3040 wrote to memory of 2620	3040	b58e0902b88405efe1ef9f61f026fd0a.exe	29
PID 3040 wrote to memory of 2620	3040	b58e0902b88405efe1ef9f61f026fd0a.exe	29
PID 3040 wrote to memory of 2620	3040	b58e0902b88405efe1ef9f61f026fd0a.exe	29

C:\Users\Admin\AppData\Local\Temp\b58e0902b88405efe1ef9f61f026fd0a.exe
"C:\Users\Admin\AppData\Local\Temp\b58e0902b88405efe1ef9f61f026fd0a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 812
  2⤵
  - Program crash
  PID:2620

memory/3040-0-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/3040-1-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/3040-3-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download