5f49b72c8ae882dce781ee5577cad83711915d21ced41285486a3cb8f5da9a7d

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 09:53

Target

b721613e7036ea11d42fe5c6def9009f.exe
Size

179KB
MD5

b721613e7036ea11d42fe5c6def9009f
SHA1

e94de3fb2a516f44f3ff7eeafbd41d4e4babd051
SHA256

5f49b72c8ae882dce781ee5577cad83711915d21ced41285486a3cb8f5da9a7d
SHA512

f0787b2e3cd3a362f807b0c3abd93a8c03e8e65794b267d4bdd81fe2a9b84b8248066f80bfd1d9e6a7b0524990fa943185c92116d9ad664968e4d12dc885e7a8
SSDEEP

3072:i5XU5EZ0EN+Gk4ocuGL72gs7xmSMMx6X6JhU7egzu/yscjCp:wWEGEN+Gk7eFcxmbENhLgzuKsF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1844	2012	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1844	2012	b721613e7036ea11d42fe5c6def9009f.exe	28
PID 2012 wrote to memory of 1844	2012	b721613e7036ea11d42fe5c6def9009f.exe	28
PID 2012 wrote to memory of 1844	2012	b721613e7036ea11d42fe5c6def9009f.exe	28
PID 2012 wrote to memory of 1844	2012	b721613e7036ea11d42fe5c6def9009f.exe	28

C:\Users\Admin\AppData\Local\Temp\b721613e7036ea11d42fe5c6def9009f.exe
"C:\Users\Admin\AppData\Local\Temp\b721613e7036ea11d42fe5c6def9009f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 584
  2⤵
  - Program crash
  PID:1844

memory/2012-0-0x0000000000D00000-0x0000000000D34000-memory.dmp

Filesize
208KB

Download
memory/2012-1-0x0000000074CD0000-0x00000000753BE000-memory.dmp

Filesize
6.9MB

Download
memory/2012-2-0x0000000000590000-0x00000000005D0000-memory.dmp

Filesize
256KB

Download
memory/2012-3-0x0000000074CD0000-0x00000000753BE000-memory.dmp

Filesize
6.9MB

Download