854d008726bdfd7d6edcae33507293ae358190479318d3a1a48ffb92b5457e8d

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-03-2024 03:11

Target

b5b84fa10836de9aa91ce48312dfbf9c.exe
Size

49KB
MD5

b5b84fa10836de9aa91ce48312dfbf9c
SHA1

fc2e15061f270f51c5bf7afc02ccadb43fbfc1ff
SHA256

854d008726bdfd7d6edcae33507293ae358190479318d3a1a48ffb92b5457e8d
SHA512

0200db25d809fb83e0d7814d47da6f3c85ad005570cc949dc1f43b9f6a1181eec804bdb9ae2270620d85ebf1234c0ddc9f8c22831d2d7b0a6f008820a01ad113
SSDEEP

768:Pw+wlBHIOzRg6/kTHpQmaeVE4lyViQp+BHrk8QP8DDkyZZb+t02cBM8Vp+TWoEYr:Pw+OiOq6BeCSdQpsHrkYDVZaaBMBSYjf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1508	1948	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1508	1948	b5b84fa10836de9aa91ce48312dfbf9c.exe	28
PID 1948 wrote to memory of 1508	1948	b5b84fa10836de9aa91ce48312dfbf9c.exe	28
PID 1948 wrote to memory of 1508	1948	b5b84fa10836de9aa91ce48312dfbf9c.exe	28
PID 1948 wrote to memory of 1508	1948	b5b84fa10836de9aa91ce48312dfbf9c.exe	28

C:\Users\Admin\AppData\Local\Temp\b5b84fa10836de9aa91ce48312dfbf9c.exe
"C:\Users\Admin\AppData\Local\Temp\b5b84fa10836de9aa91ce48312dfbf9c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 88
  2⤵
  - Program crash
  PID:1508

memory/1948-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1948-1-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download