a6e099cd2e53c3e644dcbd0b08e357389ffa542b0a182ccf678665ec9efea308

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 06:25

Target

bde5bc95a1015093e53c03f7686e6e69.exe
Size

52KB
MD5

bde5bc95a1015093e53c03f7686e6e69
SHA1

70957d3c581c169af32cfa69cfef279a0999ae0b
SHA256

a6e099cd2e53c3e644dcbd0b08e357389ffa542b0a182ccf678665ec9efea308
SHA512

28d8ec570a9aced1275ba4e8d2da643eaf779c7ee8a2b60c0c918cd7c4b9fe64e9996fd5b04849fd29bb51de53c8fb4d8a520c8b109a2e1e137ff18c4627fc4c
SSDEEP

768:71qm1x825LSZkYklsKbuS2NrN8a6Gg2dT5SEpVWOfMC5rQuK9fHkkTojv:0mxFSQlVmtxpg2dTHOc3xloPxo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1448	612	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 612 wrote to memory of 1448	612	bde5bc95a1015093e53c03f7686e6e69.exe	29
PID 612 wrote to memory of 1448	612	bde5bc95a1015093e53c03f7686e6e69.exe	29
PID 612 wrote to memory of 1448	612	bde5bc95a1015093e53c03f7686e6e69.exe	29
PID 612 wrote to memory of 1448	612	bde5bc95a1015093e53c03f7686e6e69.exe	29

C:\Users\Admin\AppData\Local\Temp\bde5bc95a1015093e53c03f7686e6e69.exe
"C:\Users\Admin\AppData\Local\Temp\bde5bc95a1015093e53c03f7686e6e69.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 612 -s 96
  2⤵
  - Program crash
  PID:1448