6b52611fe09dff07d7883fddb60cb3d24adf9de360f5dd2bea25c42dd4b5303e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 02:54

Target

ba56b1a31ca043980262c16bf6ecd861.exe
Size

118KB
MD5

ba56b1a31ca043980262c16bf6ecd861
SHA1

22242564df2452997e7f24fe6cf6809240306c70
SHA256

6b52611fe09dff07d7883fddb60cb3d24adf9de360f5dd2bea25c42dd4b5303e
SHA512

88af61d8dbd2d911c13399836339c5a5c0cfdffb0200c610475d1722694ef1d642f4266833c93be15bb003552c84be56dd975c78eef7151600a0375a52773c8f
SSDEEP

3072:nUtUBaHrXVCqzY67ip7frlGf0a4/oAlGTz71zKsbYx9i+:eUBaLgqz9qfxGBAlGTz79Ks+9F

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2832	2340	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2832	2340	ba56b1a31ca043980262c16bf6ecd861.exe	28
PID 2340 wrote to memory of 2832	2340	ba56b1a31ca043980262c16bf6ecd861.exe	28
PID 2340 wrote to memory of 2832	2340	ba56b1a31ca043980262c16bf6ecd861.exe	28
PID 2340 wrote to memory of 2832	2340	ba56b1a31ca043980262c16bf6ecd861.exe	28

C:\Users\Admin\AppData\Local\Temp\ba56b1a31ca043980262c16bf6ecd861.exe
"C:\Users\Admin\AppData\Local\Temp\ba56b1a31ca043980262c16bf6ecd861.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 36
  2⤵
  - Program crash
  PID:2832

memory/2340-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2340-1-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download