526d2de33b1efa7a3646ff6ce54b198f7aa847d564706fd4efa99d28131e103b

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 12:58

Target

b774c412251288e03314cecb6916209a.exe
Size

46KB
MD5

b774c412251288e03314cecb6916209a
SHA1

305b0d728c617fe11fd49ef43f9321fbc59c6bbf
SHA256

526d2de33b1efa7a3646ff6ce54b198f7aa847d564706fd4efa99d28131e103b
SHA512

82a08c79c9a8c41cc64579e605923ede52028453246938b7b3ce45d5e4a3a49547e1b53acbe944a092e63c801da0d7c3995737802ede33ebce869952c75aac60
SSDEEP

768:c9WIF379kKZdC9stKU0v8iAs/SPL4gmJUC3FGAr3ymsfW:uFp+9sF0vYs/SzZmuC3s+3t

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
552	1800	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 552	1800	b774c412251288e03314cecb6916209a.exe	28
PID 1800 wrote to memory of 552	1800	b774c412251288e03314cecb6916209a.exe	28
PID 1800 wrote to memory of 552	1800	b774c412251288e03314cecb6916209a.exe	28
PID 1800 wrote to memory of 552	1800	b774c412251288e03314cecb6916209a.exe	28

C:\Users\Admin\AppData\Local\Temp\b774c412251288e03314cecb6916209a.exe
"C:\Users\Admin\AppData\Local\Temp\b774c412251288e03314cecb6916209a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 136
  2⤵
  - Program crash
  PID:552