bfba1b21f308f90cc5297e62d3626c43e5a56a07c4024d2de2a9642077d9644e

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 08:00

Target

c55f9c8aa2b7fcffccce4094c4b050fa.exe
Size

76KB
MD5

c55f9c8aa2b7fcffccce4094c4b050fa
SHA1

7de7fc401c1662a5a3545d7742bcfcc1c3d7fc03
SHA256

bfba1b21f308f90cc5297e62d3626c43e5a56a07c4024d2de2a9642077d9644e
SHA512

1127d80b6e0c07ac1d837893de0e1fa4d698654d09caa35a33e4cf4e7c8db96137b3240e980558ea69f32cd5a7172603d788945f9840fdcfe71595d09dfe702f
SSDEEP

1536:9i2fQI9YBvEOCaWOKZIzEkaYkfVeekWjLSbp0q1Ejw3Mc8hxqpjVrs2ryrd1vUQ0:kptcLzlNeeI0eEjwh8hwHs2qo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2820	2808	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2820	2808	c55f9c8aa2b7fcffccce4094c4b050fa.exe	28
PID 2808 wrote to memory of 2820	2808	c55f9c8aa2b7fcffccce4094c4b050fa.exe	28
PID 2808 wrote to memory of 2820	2808	c55f9c8aa2b7fcffccce4094c4b050fa.exe	28
PID 2808 wrote to memory of 2820	2808	c55f9c8aa2b7fcffccce4094c4b050fa.exe	28

C:\Users\Admin\AppData\Local\Temp\c55f9c8aa2b7fcffccce4094c4b050fa.exe
"C:\Users\Admin\AppData\Local\Temp\c55f9c8aa2b7fcffccce4094c4b050fa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 36
  2⤵
  - Program crash
  PID:2820

memory/2808-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download