f832cf4eef0b58431a0c648300bdb2a2cf70fe5b7aad301752f4240f269cf435

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 13:35

Target

bb650a6a3baa36352cc7e5af8c799eb7.exe
Size

52KB
MD5

bb650a6a3baa36352cc7e5af8c799eb7
SHA1

e2efbf7083f59407df8c0db533ecc263b065c7ca
SHA256

f832cf4eef0b58431a0c648300bdb2a2cf70fe5b7aad301752f4240f269cf435
SHA512

11ed90de346b578e779a70913ec8f3073ae3c809e2d46b05a7a1a4aca9f42fb3cda0125bf4f05d91b2c29898da5e1bdb55dc27e26bb465a2fcf10f5f9c54ecfb
SSDEEP

768:YwrH+iN27nHaSORXZCUMh4AzNI+BGxYnjlDusjc99+rCjo0/0b2xaqMoNBrsBGdu:YwX2rpOcuAzG+Uxmjlc9o2Uqrsmcxpf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	2156	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 1708	2156	bb650a6a3baa36352cc7e5af8c799eb7.exe	28
PID 2156 wrote to memory of 1708	2156	bb650a6a3baa36352cc7e5af8c799eb7.exe	28
PID 2156 wrote to memory of 1708	2156	bb650a6a3baa36352cc7e5af8c799eb7.exe	28
PID 2156 wrote to memory of 1708	2156	bb650a6a3baa36352cc7e5af8c799eb7.exe	28

C:\Users\Admin\AppData\Local\Temp\bb650a6a3baa36352cc7e5af8c799eb7.exe
"C:\Users\Admin\AppData\Local\Temp\bb650a6a3baa36352cc7e5af8c799eb7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 88
  2⤵
  - Program crash
  PID:1708

memory/2156-0-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download