05e1e391db28af3c34b6971ec4961dbf1926a4dc2e1b678bbc07769271bf37a6

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 11:13

Target

bb1fb3048930f4d51b95667407eed9fa.exe
Size

44KB
MD5

bb1fb3048930f4d51b95667407eed9fa
SHA1

0f0ebbca61f0dd218a7d0230eace78496c9a0902
SHA256

05e1e391db28af3c34b6971ec4961dbf1926a4dc2e1b678bbc07769271bf37a6
SHA512

fe22004e8be5d9f1f5e66f435a14c0742908485a6cea38766319ca38dc0d3a5900ba8f3ffcb23b4155d1434e9fd31549aa5af51f0fdd27ef4f027722eab0e9aa
SSDEEP

768:SICtkh7XtDgsqTRXwCKDrzW1WtZBPj/Soz0BWGlWIQB0fnfBdwDpX1L7v15hCm:SICt6lS7KDPW1cJ9zKQB2ZWtX1L75

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2704	1468	WerFault.exe	27

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1468	bb1fb3048930f4d51b95667407eed9fa.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 2704	1468	bb1fb3048930f4d51b95667407eed9fa.exe	30
PID 1468 wrote to memory of 2704	1468	bb1fb3048930f4d51b95667407eed9fa.exe	30
PID 1468 wrote to memory of 2704	1468	bb1fb3048930f4d51b95667407eed9fa.exe	30
PID 1468 wrote to memory of 2704	1468	bb1fb3048930f4d51b95667407eed9fa.exe	30

C:\Users\Admin\AppData\Local\Temp\bb1fb3048930f4d51b95667407eed9fa.exe
"C:\Users\Admin\AppData\Local\Temp\bb1fb3048930f4d51b95667407eed9fa.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 152
  2⤵
  - Program crash
  PID:2704

memory/1468-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1468-1-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1468-6-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download