e792148020d2d6e3498bebe16a493ecf01b01723b64c979ba4a811b05f6b7ef6

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-03-2024 11:46

Target

db8ce55e9c115289f6c159ac36a220aa.exe
Size

185KB
MD5

db8ce55e9c115289f6c159ac36a220aa
SHA1

87f72745efbac39470d3a52f3b6e3ef84f365412
SHA256

e792148020d2d6e3498bebe16a493ecf01b01723b64c979ba4a811b05f6b7ef6
SHA512

3e44dcaba30e1c8e01137bed4164cefb8fef18fb5815e4eeee7d7c4402b07f61e918ff9524ca9871c5573d8dfac7b987bcc400b72d6738e41df7a304fc9cece2
SSDEEP

3072:YUsHrsGfPyJ95sW9Pyky8zOCbDLKyM6wMkit0wua4Do:Y7LvGMky8SCPtMmswEo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2728	2360	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2728	2360	db8ce55e9c115289f6c159ac36a220aa.exe	28
PID 2360 wrote to memory of 2728	2360	db8ce55e9c115289f6c159ac36a220aa.exe	28
PID 2360 wrote to memory of 2728	2360	db8ce55e9c115289f6c159ac36a220aa.exe	28
PID 2360 wrote to memory of 2728	2360	db8ce55e9c115289f6c159ac36a220aa.exe	28

C:\Users\Admin\AppData\Local\Temp\db8ce55e9c115289f6c159ac36a220aa.exe
"C:\Users\Admin\AppData\Local\Temp\db8ce55e9c115289f6c159ac36a220aa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 112
  2⤵
  - Program crash
  PID:2728