2ed52a4363a3c8473f504d31abd6c1c1459d380cbd68d06121ee27c498106f60

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-03-2024 13:16

Target

bb5b5eece8b941a22a0e2d3b29708fc0.exe
Size

50KB
MD5

bb5b5eece8b941a22a0e2d3b29708fc0
SHA1

ebbee6c24bb134edcaa2770fa8b75a2297f3dd53
SHA256

2ed52a4363a3c8473f504d31abd6c1c1459d380cbd68d06121ee27c498106f60
SHA512

8e0f5d3f002306cd84975d65f9127a83f7a7d9493bf7dda164901450d130d3097bb4b57d64dea436edc4b8958b441f61781be4ffa15805a50ee5eca962252072
SSDEEP

768:ah7hkD/U3SOOzQAh739SNNUPQCa+MFZLLNBnIque2PVYM0+xvB0ExgMEbKNf/ugf:ahiDUWh7tSN3lJN52NZ/xvvgMLf/j/28

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2184	1152	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2184	1152	bb5b5eece8b941a22a0e2d3b29708fc0.exe	28
PID 1152 wrote to memory of 2184	1152	bb5b5eece8b941a22a0e2d3b29708fc0.exe	28
PID 1152 wrote to memory of 2184	1152	bb5b5eece8b941a22a0e2d3b29708fc0.exe	28
PID 1152 wrote to memory of 2184	1152	bb5b5eece8b941a22a0e2d3b29708fc0.exe	28

C:\Users\Admin\AppData\Local\Temp\bb5b5eece8b941a22a0e2d3b29708fc0.exe
"C:\Users\Admin\AppData\Local\Temp\bb5b5eece8b941a22a0e2d3b29708fc0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 140
  2⤵
  - Program crash
  PID:2184

memory/1152-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1152-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download