5b1087eb16e5e689fadeed1e2a770da7b34839546469b2d9d57bed759d4f82d9

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 09:11

Target

d5bce72959dfde758d198cd5bfce2ba4.exe
Size

457KB
MD5

d5bce72959dfde758d198cd5bfce2ba4
SHA1

7b916ca6b931fafba26e4983ca8d9f82e0b89ac8
SHA256

5b1087eb16e5e689fadeed1e2a770da7b34839546469b2d9d57bed759d4f82d9
SHA512

54438938ccc8636f514bbdd8fec7ad2f69f4623daf4cfd20471b2f5b578d3883516799b4a79b1578475be9f24a4878f3d719f5a552ad2d1c51d32af8fa35cb9d
SSDEEP

6144:PYsm62bL/dOuvi6IXUiQQfTAnNXbu9jrZwz73hQ1Us/V3opWE5FbwwTL:/njfTAnpirZwztQ9w17Hn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2120	2164	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2120	2164	d5bce72959dfde758d198cd5bfce2ba4.exe	28
PID 2164 wrote to memory of 2120	2164	d5bce72959dfde758d198cd5bfce2ba4.exe	28
PID 2164 wrote to memory of 2120	2164	d5bce72959dfde758d198cd5bfce2ba4.exe	28
PID 2164 wrote to memory of 2120	2164	d5bce72959dfde758d198cd5bfce2ba4.exe	28

C:\Users\Admin\AppData\Local\Temp\d5bce72959dfde758d198cd5bfce2ba4.exe
"C:\Users\Admin\AppData\Local\Temp\d5bce72959dfde758d198cd5bfce2ba4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 200
  2⤵
  - Program crash
  PID:2120

memory/2164-0-0x0000000001000000-0x0000000001075000-memory.dmp

Filesize
468KB

Download