47ff1730ad6f7f592a7d500fd93f743ae1d91144d8307ac4366019d381f56622

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-03-2024 00:32

Target

ba10478d406c53e06b4654ac3950bfea.exe
Size

329KB
MD5

ba10478d406c53e06b4654ac3950bfea
SHA1

2d53a19fe5b060200ea3724569f8719f3afb723c
SHA256

47ff1730ad6f7f592a7d500fd93f743ae1d91144d8307ac4366019d381f56622
SHA512

a10b198d1d9570d80e23b4f0290bde81239c7ad585d4a928b58c6a7ca32eb31e916b7eccc68f7d6017f01ac83a988c55c6cc43844495b10734ea510bf880d13f
SSDEEP

6144:9NNN+EUQbxcveBwSjsluIpT+6Y79SCvRFT5lRr6E8RwNmRR5Iey:9/cQymBwSjsjpT+6ESCvRx5Hr6E8RwNd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2800	2164	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2800	2164	ba10478d406c53e06b4654ac3950bfea.exe	28
PID 2164 wrote to memory of 2800	2164	ba10478d406c53e06b4654ac3950bfea.exe	28
PID 2164 wrote to memory of 2800	2164	ba10478d406c53e06b4654ac3950bfea.exe	28
PID 2164 wrote to memory of 2800	2164	ba10478d406c53e06b4654ac3950bfea.exe	28

C:\Users\Admin\AppData\Local\Temp\ba10478d406c53e06b4654ac3950bfea.exe
"C:\Users\Admin\AppData\Local\Temp\ba10478d406c53e06b4654ac3950bfea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 116
  2⤵
  - Program crash
  PID:2800

memory/2164-0-0x0000000001010000-0x0000000001066000-memory.dmp

Filesize
344KB

Download