054b6ed7d24e45ac73ca291356d1c72da73478c38e8a40ee4c0dffa9f175217d

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 12:50

Target

bb4d982c57adccb4afeba94337454d9e.exe
Size

364KB
MD5

bb4d982c57adccb4afeba94337454d9e
SHA1

6e7ca78a17e10c97969abc23d78badfe20642587
SHA256

054b6ed7d24e45ac73ca291356d1c72da73478c38e8a40ee4c0dffa9f175217d
SHA512

3f179653e12709f430a17f74305bca6367505e05c1195432a1fe31d3f40a51f29aed797eae2d1767f080f6ecf38f7ae913931c600cb5b52dad72659a9632cf2b
SSDEEP

6144:rpEcAd/Mm5ZkyUneRTnJOmQ4W4/6zA5K0TzJRCp4xRvKUllD/W13+a:rTAOm5eyUnJmCzAXTzJR3RvK6lCwa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2504	2596	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2504	2596	bb4d982c57adccb4afeba94337454d9e.exe	28
PID 2596 wrote to memory of 2504	2596	bb4d982c57adccb4afeba94337454d9e.exe	28
PID 2596 wrote to memory of 2504	2596	bb4d982c57adccb4afeba94337454d9e.exe	28
PID 2596 wrote to memory of 2504	2596	bb4d982c57adccb4afeba94337454d9e.exe	28

C:\Users\Admin\AppData\Local\Temp\bb4d982c57adccb4afeba94337454d9e.exe
"C:\Users\Admin\AppData\Local\Temp\bb4d982c57adccb4afeba94337454d9e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 116
  2⤵
  - Program crash
  PID:2504

memory/2596-0-0x00000000001B0000-0x0000000000210000-memory.dmp

Filesize
384KB

Download