f17d4b57f9622bc033599cbe77c9a12731ff8ba68c4e90c1c5112f6a1048d880

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 03:52

Target

ba7118aa311f521e904848684d8d9f13.exe
Size

126KB
MD5

ba7118aa311f521e904848684d8d9f13
SHA1

a9031d905cad3f1070c6f5b159c2ca28af562ff7
SHA256

f17d4b57f9622bc033599cbe77c9a12731ff8ba68c4e90c1c5112f6a1048d880
SHA512

dce9ae5cf206d8fa63154ef95d5144a16254e8df52db73f584ab9670592c61a9e6e2437b5dca3589330af699aadc87250884749d525b274f1d72f5f5887add8e
SSDEEP

3072:i3vPGRahRNUYDt2/0UZkV7K2BQNp+eXvUvhYiwsqYJL3B0TOgncFao:i3v+RsEAmCnCN4bAlYf0TEb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1044	2168	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1044	2168	ba7118aa311f521e904848684d8d9f13.exe	28
PID 2168 wrote to memory of 1044	2168	ba7118aa311f521e904848684d8d9f13.exe	28
PID 2168 wrote to memory of 1044	2168	ba7118aa311f521e904848684d8d9f13.exe	28
PID 2168 wrote to memory of 1044	2168	ba7118aa311f521e904848684d8d9f13.exe	28

C:\Users\Admin\AppData\Local\Temp\ba7118aa311f521e904848684d8d9f13.exe
"C:\Users\Admin\AppData\Local\Temp\ba7118aa311f521e904848684d8d9f13.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 36
  2⤵
  - Program crash
  PID:1044

memory/2168-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2168-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download