f6d95aad5532514b69215273bc5be4d2fed51fabe13154954d0f889b5db4a5f5

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-03-2024 11:01

Target

b893ebd19b9ed633fb5889944569ca8c.exe
Size

127KB
MD5

b893ebd19b9ed633fb5889944569ca8c
SHA1

bd03e47dadb8f211228ebf342e8cdbc96dbe8d09
SHA256

f6d95aad5532514b69215273bc5be4d2fed51fabe13154954d0f889b5db4a5f5
SHA512

7a0cd409f4c951e496e605edb92f53cac34c9c0db6587f1c73fe6b9fd8035d294c845733ddc142f5de1c4dab2785478c3f7d15f6084bc58942b22ecef857b33e
SSDEEP

1536:otRvWK3IeWpK9L6QQTkHV3D3RQID2XgHKQNpDB9xA2zO3B0LnyTSbo0VivpICjar:otR6YAm3rRQXWJDHxALOyX0VGra/UmR5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2196	2100	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2196	2100	b893ebd19b9ed633fb5889944569ca8c.exe	28
PID 2100 wrote to memory of 2196	2100	b893ebd19b9ed633fb5889944569ca8c.exe	28
PID 2100 wrote to memory of 2196	2100	b893ebd19b9ed633fb5889944569ca8c.exe	28
PID 2100 wrote to memory of 2196	2100	b893ebd19b9ed633fb5889944569ca8c.exe	28

C:\Users\Admin\AppData\Local\Temp\b893ebd19b9ed633fb5889944569ca8c.exe
"C:\Users\Admin\AppData\Local\Temp\b893ebd19b9ed633fb5889944569ca8c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 36
  2⤵
  - Program crash
  PID:2196

memory/2100-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2100-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download