680cce9af2482e8c3f856f064313892aae365df8c0e05c4860302225573884c4

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 15:30

Target

bef6af9775494c3c06c6fc5c1d046840.exe
Size

55KB
MD5

bef6af9775494c3c06c6fc5c1d046840
SHA1

c8e0f4d16b7debbdcd2de45797e4b620c485bbe7
SHA256

680cce9af2482e8c3f856f064313892aae365df8c0e05c4860302225573884c4
SHA512

ca70ebec4bc4b54cc779e3fc4d320b43abbf63215d9b7585642afb9a8b6fb8bd1d3151cdb91c8ff838cd35c7b44e869cb5d24c09bb0bb20d015e9d51cf64184c
SSDEEP

768:sMqtc7Py2Jztm8vGNjZkGG0Gsio5hjCuC6duaeQH5FrxsLj1R1Uvxp2p/1H5EXdh:sKPzmm/PONuiLGCr2L4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2052	2244	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2052	2244	bef6af9775494c3c06c6fc5c1d046840.exe	28
PID 2244 wrote to memory of 2052	2244	bef6af9775494c3c06c6fc5c1d046840.exe	28
PID 2244 wrote to memory of 2052	2244	bef6af9775494c3c06c6fc5c1d046840.exe	28
PID 2244 wrote to memory of 2052	2244	bef6af9775494c3c06c6fc5c1d046840.exe	28

C:\Users\Admin\AppData\Local\Temp\bef6af9775494c3c06c6fc5c1d046840.exe
"C:\Users\Admin\AppData\Local\Temp\bef6af9775494c3c06c6fc5c1d046840.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 140
  2⤵
  - Program crash
  PID:2052

memory/2244-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2244-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download