6854e3fa80c62461c88197f0161d3b4040230f86f818b626b9ffe13d61a12d87

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 11:26

Target

bb2581163aeb6121a7e36581cf01ce7e.exe
Size

26KB
MD5

bb2581163aeb6121a7e36581cf01ce7e
SHA1

9eb48372562b901ab97f25e9e6cbfdc6b9376327
SHA256

6854e3fa80c62461c88197f0161d3b4040230f86f818b626b9ffe13d61a12d87
SHA512

5fdd96b69490e53266a47528fc1aacaef9daba0ff9279a9e31f04cdfc4bde41609e5db0515e308472038135afbc469af3e6fcf7dc59b8edc4e359f44616781b3
SSDEEP

384:38zIhOcql6/i9p5GBFK08Iu/DmzATFDMCVVRNzsG5jtkeYI4awzfMGNtoXaAiF:38KCpIFHEYknzsG5jWU4jvoXfS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2988	2192	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2988	2192	bb2581163aeb6121a7e36581cf01ce7e.exe	28
PID 2192 wrote to memory of 2988	2192	bb2581163aeb6121a7e36581cf01ce7e.exe	28
PID 2192 wrote to memory of 2988	2192	bb2581163aeb6121a7e36581cf01ce7e.exe	28
PID 2192 wrote to memory of 2988	2192	bb2581163aeb6121a7e36581cf01ce7e.exe	28

C:\Users\Admin\AppData\Local\Temp\bb2581163aeb6121a7e36581cf01ce7e.exe
"C:\Users\Admin\AppData\Local\Temp\bb2581163aeb6121a7e36581cf01ce7e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 88
  2⤵
  - Program crash
  PID:2988

memory/2192-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2192-2-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2192-1-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download