52e1442f07a68ce2a7e60e76fd60cbb8fe1c6a2a422a54397c7ec35a4ff667b7

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 13:47

Target

bb6a6389392c51085a8590ba1846a89c.exe
Size

124KB
MD5

bb6a6389392c51085a8590ba1846a89c
SHA1

ac729d3cdc109af5a7304d072d3ac1a794aa589b
SHA256

52e1442f07a68ce2a7e60e76fd60cbb8fe1c6a2a422a54397c7ec35a4ff667b7
SHA512

edd0946ce1612cdcdee7464d76d53a31c38c94a69430a733731e2b25f4cedf22b2c8b67b6272577810a442f2d4081d1d5c22bb8275d20713e971c006e9cf9726
SSDEEP

1536:zLM+azMAjzsugXY3kFq+FZbU4hO8gt+jlvBR8WtBw2TVl127I42cm42mXA2J9aB0:XnazMAjzuYx8IT+jzRHtWeJ2v23o99

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2756	2760	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2756	2760	bb6a6389392c51085a8590ba1846a89c.exe	28
PID 2760 wrote to memory of 2756	2760	bb6a6389392c51085a8590ba1846a89c.exe	28
PID 2760 wrote to memory of 2756	2760	bb6a6389392c51085a8590ba1846a89c.exe	28
PID 2760 wrote to memory of 2756	2760	bb6a6389392c51085a8590ba1846a89c.exe	28

C:\Users\Admin\AppData\Local\Temp\bb6a6389392c51085a8590ba1846a89c.exe
"C:\Users\Admin\AppData\Local\Temp\bb6a6389392c51085a8590ba1846a89c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 92
  2⤵
  - Program crash
  PID:2756