31b970b376409ac9ff87dc81d79fc9b08d9adfbda365592e6b890a38f15c85ea

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 04:19

Target

ba7f38113963bbc3ae6a027118b4e434.exe
Size

195KB
MD5

ba7f38113963bbc3ae6a027118b4e434
SHA1

59506889ef9747d22a29babda1cd30b2b24555f8
SHA256

31b970b376409ac9ff87dc81d79fc9b08d9adfbda365592e6b890a38f15c85ea
SHA512

f2d491331cf81a6e61780510202309ab3da7e83bcd735a50bb99bc893b7e8fd4b1117049b1976cbaf573aeab500abb3d2aadcc8ec1511d4ca9b874ee85473038
SSDEEP

3072:TRcEC2Oi8NXC797F8TBfFvj4bq57ACPFz0Ux60DDp+qYg4MId:TpC2F8NXC796TB9vj48JTxKg41

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3048	2784	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 3048	2784	ba7f38113963bbc3ae6a027118b4e434.exe	28
PID 2784 wrote to memory of 3048	2784	ba7f38113963bbc3ae6a027118b4e434.exe	28
PID 2784 wrote to memory of 3048	2784	ba7f38113963bbc3ae6a027118b4e434.exe	28
PID 2784 wrote to memory of 3048	2784	ba7f38113963bbc3ae6a027118b4e434.exe	28

C:\Users\Admin\AppData\Local\Temp\ba7f38113963bbc3ae6a027118b4e434.exe
"C:\Users\Admin\AppData\Local\Temp\ba7f38113963bbc3ae6a027118b4e434.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 460
  2⤵
  - Program crash
  PID:3048

memory/2784-0-0x0000000000020000-0x0000000000038000-memory.dmp

Filesize
96KB

Download
memory/2784-8-0x0000000000560000-0x0000000000570000-memory.dmp

Filesize
64KB

Download
memory/2784-7-0x0000000000560000-0x0000000000570000-memory.dmp

Filesize
64KB

Download
memory/2784-6-0x0000000000560000-0x0000000000570000-memory.dmp

Filesize
64KB

Download
memory/2784-5-0x0000000000560000-0x0000000000570000-memory.dmp

Filesize
64KB

Download
memory/2784-4-0x0000000000560000-0x0000000000570000-memory.dmp

Filesize
64KB

Download
memory/2784-3-0x0000000000560000-0x0000000000570000-memory.dmp

Filesize
64KB

Download
memory/2784-9-0x0000000075E30000-0x0000000075F40000-memory.dmp

Filesize
1.1MB

Download
memory/2784-10-0x0000000000560000-0x0000000000570000-memory.dmp

Filesize
64KB

Download
memory/2784-11-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/2784-12-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download