8bf2ea823d4c62291bf49f2e79dfdd9af5b7ffc7f9efd75088ba63c05f1de0c0

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 10:19

Target

d5ddc33bf68773874931f2157559eb0b.exe
Size

55KB
MD5

d5ddc33bf68773874931f2157559eb0b
SHA1

50aa37e53c2505f2c6e5ed78e9a2d2c517ccbd21
SHA256

8bf2ea823d4c62291bf49f2e79dfdd9af5b7ffc7f9efd75088ba63c05f1de0c0
SHA512

d4d8bc89f8e1d0c699e31d30edf32473efb504165a5e98c853e34d8b126f37bceea58f0990d7c3dd09024820f0dd18b6d05f9d0655c087b1b03b1333a0dfe20b
SSDEEP

768:a6M6p3uGkN/Y5MGFax31KsljfkO49GUx360RbFx2p/1H5+Xdnh:a6pp3udNJGFa/H49G81NFx2LO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
968	1712	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 968	1712	d5ddc33bf68773874931f2157559eb0b.exe	28
PID 1712 wrote to memory of 968	1712	d5ddc33bf68773874931f2157559eb0b.exe	28
PID 1712 wrote to memory of 968	1712	d5ddc33bf68773874931f2157559eb0b.exe	28
PID 1712 wrote to memory of 968	1712	d5ddc33bf68773874931f2157559eb0b.exe	28

C:\Users\Admin\AppData\Local\Temp\d5ddc33bf68773874931f2157559eb0b.exe
"C:\Users\Admin\AppData\Local\Temp\d5ddc33bf68773874931f2157559eb0b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 140
  2⤵
  - Program crash
  PID:968

memory/1712-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1712-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download