107881f9c2e463caf00255fecba0d6369bcc1e6e96d399ed53c401240c8979b5

Analysis

max time kernel
120s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 16:57

Target

b9334b699219a2e337bb662b09d1509a.exe
Size

335KB
MD5

b9334b699219a2e337bb662b09d1509a
SHA1

89d79751e35ae2b36bbd309950744a89ae6b28a1
SHA256

107881f9c2e463caf00255fecba0d6369bcc1e6e96d399ed53c401240c8979b5
SHA512

4787b0778aa142d5eea1263454b5e9e260535c0f2dec06f1cd066a91261743a70dccfb81258113db27acf653f6d85a6c74cef3419a14959f12cabf1f17688e24
SSDEEP

6144:j9EScmIdTHUI8/jBGk2+qj8e5wamJs34yQzM8pqtAnOg0d5pjj0B:j9rrIdl8/tGk29g37JsFMM8pqtBj0B

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1944	1740	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1944	1740	b9334b699219a2e337bb662b09d1509a.exe	28
PID 1740 wrote to memory of 1944	1740	b9334b699219a2e337bb662b09d1509a.exe	28
PID 1740 wrote to memory of 1944	1740	b9334b699219a2e337bb662b09d1509a.exe	28
PID 1740 wrote to memory of 1944	1740	b9334b699219a2e337bb662b09d1509a.exe	28

C:\Users\Admin\AppData\Local\Temp\b9334b699219a2e337bb662b09d1509a.exe
"C:\Users\Admin\AppData\Local\Temp\b9334b699219a2e337bb662b09d1509a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 152
  2⤵
  - Program crash
  PID:1944

memory/1740-0-0x0000000000FF0000-0x0000000001048000-memory.dmp

Filesize
352KB

Download