2f33d7b353f1e4418c70cba45f552b67864877deae59259d53078f2f6ca83502

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 16:02

Target

b7ce8af3deb97fa0617caf87784588f6.exe
Size

123KB
MD5

b7ce8af3deb97fa0617caf87784588f6
SHA1

05517208e036ed955bf4bc7e7eb3df56b3d186b8
SHA256

2f33d7b353f1e4418c70cba45f552b67864877deae59259d53078f2f6ca83502
SHA512

dea3c9bfb99e4f3c15a31a26f7130d7dde22f7201cdbe54c2080cecb29d6afd66aacad104709022f2f902d37bf29ec3ec246428b31947bdbe495451bafb8021b
SSDEEP

3072:SicUkj9osQ7DeYboeS7/EYe1aoambPtenusVr3EiTYHi4P8lElauGS7h:J7kj9SeYHqfesoa0jer3Eiw7P8lCZGSd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2600	3012	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2600	3012	b7ce8af3deb97fa0617caf87784588f6.exe	28
PID 3012 wrote to memory of 2600	3012	b7ce8af3deb97fa0617caf87784588f6.exe	28
PID 3012 wrote to memory of 2600	3012	b7ce8af3deb97fa0617caf87784588f6.exe	28
PID 3012 wrote to memory of 2600	3012	b7ce8af3deb97fa0617caf87784588f6.exe	28

C:\Users\Admin\AppData\Local\Temp\b7ce8af3deb97fa0617caf87784588f6.exe
"C:\Users\Admin\AppData\Local\Temp\b7ce8af3deb97fa0617caf87784588f6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 44
  2⤵
  - Program crash
  PID:2600

memory/3012-0-0x0000000000400000-0x0000000000420200-memory.dmp

Filesize
128KB

Download