1fb792976d370e4d9611f377c776ef977da64f3614855aa2ac1e4148c0ce3233

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 05:07

Target

ba9749d4b6e2ac65286bc1b627735828.exe
Size

25KB
MD5

ba9749d4b6e2ac65286bc1b627735828
SHA1

8a3aa23f05d8578b934c94b62c67efaa7a655676
SHA256

1fb792976d370e4d9611f377c776ef977da64f3614855aa2ac1e4148c0ce3233
SHA512

236dc04b22759b75452c73d55dc677d694584c739a10fcb1f2a94fdbec7d0f582242b98f46c17d72dfe8e32749201d3e82e256358816be76e2132fca6dcbf357
SSDEEP

384:C2LJi5IHM/vpGAIOmgU+h+xGDNVcYw6ra3qjRHPgaDB1LlThuZvibG:Fy/xGYmgJoGBemrdpgeB1RT+6bG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1668	2080	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1668	2080	ba9749d4b6e2ac65286bc1b627735828.exe	28
PID 2080 wrote to memory of 1668	2080	ba9749d4b6e2ac65286bc1b627735828.exe	28
PID 2080 wrote to memory of 1668	2080	ba9749d4b6e2ac65286bc1b627735828.exe	28
PID 2080 wrote to memory of 1668	2080	ba9749d4b6e2ac65286bc1b627735828.exe	28

C:\Users\Admin\AppData\Local\Temp\ba9749d4b6e2ac65286bc1b627735828.exe
"C:\Users\Admin\AppData\Local\Temp\ba9749d4b6e2ac65286bc1b627735828.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 64
  2⤵
  - Program crash
  PID:1668