734c3a2439f5314541ce42350fa675f8dbf42aca3fc03d6344d73f570c586076

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 13:56

Target

cb94a38c6a4155f35ed81eb31ef35266.exe
Size

195KB
MD5

cb94a38c6a4155f35ed81eb31ef35266
SHA1

db53f672fdacea5ce8a26f8f5a6ebae847d63af0
SHA256

734c3a2439f5314541ce42350fa675f8dbf42aca3fc03d6344d73f570c586076
SHA512

5427a467a918bb7f0e94c06c5bc4b25879cc36856e88de376428a5949f355df8993d05534e0d2b742bf85da127e0c242a27acbcdfdd8b344b72e7497dae83d96
SSDEEP

3072:CS6y0OUewZASlgTqECAMCazuu7fmgEr45NU/07w8/ndPECWgu:CS6lLZAeEuuu55NU/07wwndP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2024	3024	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2024	3024	cb94a38c6a4155f35ed81eb31ef35266.exe	28
PID 3024 wrote to memory of 2024	3024	cb94a38c6a4155f35ed81eb31ef35266.exe	28
PID 3024 wrote to memory of 2024	3024	cb94a38c6a4155f35ed81eb31ef35266.exe	28
PID 3024 wrote to memory of 2024	3024	cb94a38c6a4155f35ed81eb31ef35266.exe	28

C:\Users\Admin\AppData\Local\Temp\cb94a38c6a4155f35ed81eb31ef35266.exe
"C:\Users\Admin\AppData\Local\Temp\cb94a38c6a4155f35ed81eb31ef35266.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 116
  2⤵
  - Program crash
  PID:2024

memory/3024-0-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/3024-1-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download