b539db84242064ffa198930daa8de866dcb9695191cf14ac7358def98a48f675

Analysis

max time kernel
142s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 15:51

Target

bc339b1f4a24606681f169749288f616.exe
Size

112KB
MD5

bc339b1f4a24606681f169749288f616
SHA1

c4e94b00a40a9ca6ea5740c62a88d27b1b62499b
SHA256

b539db84242064ffa198930daa8de866dcb9695191cf14ac7358def98a48f675
SHA512

ff1cde096ab27c9aba288cec7cd751935e4000778e896e0ad1f4c0317d915858a01856a9073e10149905e0743669c5fdfe33dfbe106bc2d1186380c039f5c873
SSDEEP

1536:soSshlQ2Tzrms+fb0a+/Ov7nIg1platrRQ7oNdIQC3CZURDoq4OZZZLlCIib:soPhu2Z+fYxWv7nJ17ZoSyWRD68wb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2872	2664	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2872	2664	bc339b1f4a24606681f169749288f616.exe	28
PID 2664 wrote to memory of 2872	2664	bc339b1f4a24606681f169749288f616.exe	28
PID 2664 wrote to memory of 2872	2664	bc339b1f4a24606681f169749288f616.exe	28
PID 2664 wrote to memory of 2872	2664	bc339b1f4a24606681f169749288f616.exe	28

C:\Users\Admin\AppData\Local\Temp\bc339b1f4a24606681f169749288f616.exe
"C:\Users\Admin\AppData\Local\Temp\bc339b1f4a24606681f169749288f616.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 108
  2⤵
  - Program crash
  PID:2872

memory/2664-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download