807366cdfe63d8482dc252a7ebbf3fdbd74836372267dcc483b28156ea065e35

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 21:56

Target

b9c13327287d44da7c950c8d5e30b98f.exe
Size

1.1MB
MD5

b9c13327287d44da7c950c8d5e30b98f
SHA1

c4a3e361da77b18e3c54fbb99067b1483bbd4485
SHA256

807366cdfe63d8482dc252a7ebbf3fdbd74836372267dcc483b28156ea065e35
SHA512

a3bd4237da1b15dafd3524975faa57de45c06a4186dd5691ad6612e1bd7b58fc2f9b475cfabc75c7b15f189f84518c0ccbff8a67f7c5726158de6c314116644a
SSDEEP

12288:gyNrRhEuze8QHyWcLaTGXOpvHS98qjw6fNUSK+oSCXd1nLPiinpMoY/UvcYWyCFE:gy9RqGuHyWR0OhTq6iiSoY8EnH6GPC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1736	2008	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1736	2008	b9c13327287d44da7c950c8d5e30b98f.exe	28
PID 2008 wrote to memory of 1736	2008	b9c13327287d44da7c950c8d5e30b98f.exe	28
PID 2008 wrote to memory of 1736	2008	b9c13327287d44da7c950c8d5e30b98f.exe	28
PID 2008 wrote to memory of 1736	2008	b9c13327287d44da7c950c8d5e30b98f.exe	28

C:\Users\Admin\AppData\Local\Temp\b9c13327287d44da7c950c8d5e30b98f.exe
"C:\Users\Admin\AppData\Local\Temp\b9c13327287d44da7c950c8d5e30b98f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 200
  2⤵
  - Program crash
  PID:1736

memory/2008-0-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/2008-1-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download