b56bcb3a1f8a323e37f219b9ad0e41d720e87d9fc00c0cf8701de02455ab7024

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 03:28

Target

bfb98e16b031218bc2d47b48661f6fe5.exe
Size

102KB
MD5

bfb98e16b031218bc2d47b48661f6fe5
SHA1

801ad68fe523f4a7de4c4fc3991cfb2ca6bfce93
SHA256

b56bcb3a1f8a323e37f219b9ad0e41d720e87d9fc00c0cf8701de02455ab7024
SHA512

d5bd51c773aa26c1b6f315bd09914fe56fc6e0c762818e81c3f8fd096ec35c1279f97bfe9d4161b2e3a8e3bb28a664b9cebaaae962779a91f67f571a749bb304
SSDEEP

3072:6jB2YzdnvBBX/FYuNYkUcAuBHOMnwS9C1PoN5YsTOGY413Om:6nNvB5NykUcAmHOMn5CcC813Om

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2608	2156	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2608	2156	bfb98e16b031218bc2d47b48661f6fe5.exe	28
PID 2156 wrote to memory of 2608	2156	bfb98e16b031218bc2d47b48661f6fe5.exe	28
PID 2156 wrote to memory of 2608	2156	bfb98e16b031218bc2d47b48661f6fe5.exe	28
PID 2156 wrote to memory of 2608	2156	bfb98e16b031218bc2d47b48661f6fe5.exe	28

C:\Users\Admin\AppData\Local\Temp\bfb98e16b031218bc2d47b48661f6fe5.exe
"C:\Users\Admin\AppData\Local\Temp\bfb98e16b031218bc2d47b48661f6fe5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 36
  2⤵
  - Program crash
  PID:2608

memory/2156-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2156-1-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download