bbf759080d16f113278020778a65a40113e92c9608257f62cf32c776e9ba0825

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 05:16

Target

bdc08891c9c568462c7a0ba10d6852c0.exe
Size

42KB
MD5

bdc08891c9c568462c7a0ba10d6852c0
SHA1

1664440c8668f2ed2a9a6f7e8e315d7ebb485a2c
SHA256

bbf759080d16f113278020778a65a40113e92c9608257f62cf32c776e9ba0825
SHA512

1ac90819868edcfd795b01716a08f56b502c2123173e1d8d3e297ad14f636e093311f042c43c54840b3108a2835b1580da3122157da465bf6df041cb5226df72
SSDEEP

768:aaquZd1757oXYq9/3GMe005klN2r+ZgMAyBzTZcW88DgKB7:wu/904Me005oNd+6B7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2696	3012	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2696	3012	bdc08891c9c568462c7a0ba10d6852c0.exe	28
PID 3012 wrote to memory of 2696	3012	bdc08891c9c568462c7a0ba10d6852c0.exe	28
PID 3012 wrote to memory of 2696	3012	bdc08891c9c568462c7a0ba10d6852c0.exe	28
PID 3012 wrote to memory of 2696	3012	bdc08891c9c568462c7a0ba10d6852c0.exe	28

C:\Users\Admin\AppData\Local\Temp\bdc08891c9c568462c7a0ba10d6852c0.exe
"C:\Users\Admin\AppData\Local\Temp\bdc08891c9c568462c7a0ba10d6852c0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 128
  2⤵
  - Program crash
  PID:2696

memory/3012-0-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/3012-1-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download