22f1c17e37eff90e59a0551a7782f5b7d692a51aa08367eb75b36f8a93fdf89e

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 14:21

Target

bed34eb2f25eea33c74e4834a2058f41.exe
Size

33KB
MD5

bed34eb2f25eea33c74e4834a2058f41
SHA1

d7d55588ea3924da38bafdeb30be8c2d85e75fef
SHA256

22f1c17e37eff90e59a0551a7782f5b7d692a51aa08367eb75b36f8a93fdf89e
SHA512

cc5a407ac29a1dd5d325c42ce22d29f15e48258945c254157ead9bc35ba1068b70b436ff2638562ac9bf46e820257605528002e5959386a58470f5058bb7badd
SSDEEP

768:/WboJeRxoKoUMhQMszcLWKvfRt4c/nXXnXhG5jXmSsnXXnXkSWh5VQXXQ5XPEjfU:2qRUMimqKvfT42XXXhG5rmSsXXXwVAXm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2888	1500	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 2888	1500	bed34eb2f25eea33c74e4834a2058f41.exe	28
PID 1500 wrote to memory of 2888	1500	bed34eb2f25eea33c74e4834a2058f41.exe	28
PID 1500 wrote to memory of 2888	1500	bed34eb2f25eea33c74e4834a2058f41.exe	28
PID 1500 wrote to memory of 2888	1500	bed34eb2f25eea33c74e4834a2058f41.exe	28

C:\Users\Admin\AppData\Local\Temp\bed34eb2f25eea33c74e4834a2058f41.exe
"C:\Users\Admin\AppData\Local\Temp\bed34eb2f25eea33c74e4834a2058f41.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 36
  2⤵
  - Program crash
  PID:2888

memory/1500-1-0x0000000000400000-0x000000000044D6E2-memory.dmp

Filesize
309KB

Download
memory/1500-0-0x0000000000400000-0x000000000044D6E2-memory.dmp

Filesize
309KB

Download