8db86a2e07bee0d40bcc47bae205f1f59cc131b0b4b0405f297fa75b4142e541

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/03/2024, 00:57

Target
cf859da0e0a21745830a60cbae011bba.exe
Size 332KB
Sample240317-bbcmgaae97
SHA256 8db86a2e07bee0d40bcc47bae205f1f59cc131b0b4b0405f297fa75b4142e541
MD5 cf859da0e0a21745830a60cbae011bba
SHA1 93c2b676f67c43720bc47bba35c579336de59b52
SHA512 afe59a0c2df5027f2d16c0f1c6d01f63fb250cbb4f07b6e667763121280da23cff40aca0bb21aadd78f3425c8801e85f44f850d1cd6d276eaccf08e9d60bd0a3
SSDEEP 3072:RUlC5OUidcq6al0P7r1fN4MCJJ+j07pJtr11d7OkQK/HDCMkcawCKnn1fxXQXx2E:RUlC5gv6al099YpR1okQk+wek2t1l
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2020	2192	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2020	2192	cf859da0e0a21745830a60cbae011bba.exe	28
PID 2192 wrote to memory of 2020	2192	cf859da0e0a21745830a60cbae011bba.exe	28
PID 2192 wrote to memory of 2020	2192	cf859da0e0a21745830a60cbae011bba.exe	28
PID 2192 wrote to memory of 2020	2192	cf859da0e0a21745830a60cbae011bba.exe	28

C:\Users\Admin\AppData\Local\Temp\cf859da0e0a21745830a60cbae011bba.exe
"C:\Users\Admin\AppData\Local\Temp\cf859da0e0a21745830a60cbae011bba.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 148
  2⤵
  - Program crash
  PID:2020

memory/2192-0-0x0000000000400000-0x0000000000453000-memory.dmp

Download