1c6925565bc2cb526a09fce3c7bb69d66620275e89c27e3aa1b48c58ac460f49

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 20:31

Target

b81dfa2eda8e592114642aeea24a3c41.exe
Size

66KB
MD5

b81dfa2eda8e592114642aeea24a3c41
SHA1

c40389b3857350fde6470e3c2e0e57495476ab32
SHA256

1c6925565bc2cb526a09fce3c7bb69d66620275e89c27e3aa1b48c58ac460f49
SHA512

c1b4ea001ab89a7cc1384320e2d3b9b41fb836c5c0d7bb1da51c225fb625d5b067de3a8f0fa39cfdb107384367d82ea041c2d753ebf8b894edd344f386985e26
SSDEEP

1536:0YUFrOq3Y7bElvy1F+XYQ/wG3vQLJ1QU0NqlVII:0YUFrb3YfElcF+IQ/vAJ1QrqfII

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3024	2888	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 3024	2888	b81dfa2eda8e592114642aeea24a3c41.exe	28
PID 2888 wrote to memory of 3024	2888	b81dfa2eda8e592114642aeea24a3c41.exe	28
PID 2888 wrote to memory of 3024	2888	b81dfa2eda8e592114642aeea24a3c41.exe	28
PID 2888 wrote to memory of 3024	2888	b81dfa2eda8e592114642aeea24a3c41.exe	28

C:\Users\Admin\AppData\Local\Temp\b81dfa2eda8e592114642aeea24a3c41.exe
"C:\Users\Admin\AppData\Local\Temp\b81dfa2eda8e592114642aeea24a3c41.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 88
  2⤵
  - Program crash
  PID:3024

memory/2888-1-0x0000000000400000-0x0000000000416637-memory.dmp

Filesize
89KB

Download
memory/2888-0-0x0000000000400000-0x0000000000416637-memory.dmp

Filesize
89KB

Download