dfc687d4edb1cfd7eb23915172191463420464c6e535c6756c13ddc700c6185a

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-03-2024 10:27

Target

bb07135148a1cc25df65857d6c6353ef.exe
Size

83KB
MD5

bb07135148a1cc25df65857d6c6353ef
SHA1

03d1f3a73549030fd20ddfa345749704255f28e3
SHA256

dfc687d4edb1cfd7eb23915172191463420464c6e535c6756c13ddc700c6185a
SHA512

34e31ac446b672a6f0c02b6137a4ee87ddec09f63f046936f8a1ab0c33baba54462f90c71d52426272f196644b3f38d217ea9d68c0eb7def49df13ef3a44a201
SSDEEP

1536:asbVswDlskElXmeX/R/v7eAn5tVrWhwN+ux5Q4pjVrs2ryrd1vUQuq44KEkLU:vbDDlskElXm8BTD8wNXhHs2qSw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1680	2044	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1680	2044	bb07135148a1cc25df65857d6c6353ef.exe	30
PID 2044 wrote to memory of 1680	2044	bb07135148a1cc25df65857d6c6353ef.exe	30
PID 2044 wrote to memory of 1680	2044	bb07135148a1cc25df65857d6c6353ef.exe	30
PID 2044 wrote to memory of 1680	2044	bb07135148a1cc25df65857d6c6353ef.exe	30

C:\Users\Admin\AppData\Local\Temp\bb07135148a1cc25df65857d6c6353ef.exe
"C:\Users\Admin\AppData\Local\Temp\bb07135148a1cc25df65857d6c6353ef.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 36
  2⤵
  - Program crash
  PID:1680

memory/2044-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download