ba565ff6b970cc298347b0c900c3faa474b6aeddab5459cf4d08bfaee75fa26a

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-04-2024 01:31

Target

ba565ff6b970cc298347b0c900c3faa474b6aeddab5459cf4d08bfaee75fa26a.exe
Size

288KB
MD5

cba17e1418112ac9f33120229be7b9ef
SHA1

9ef4f9d75e4ddfc82af8c9196bb21a38c10ae04c
SHA256

ba565ff6b970cc298347b0c900c3faa474b6aeddab5459cf4d08bfaee75fa26a
SHA512

2872396eb0e8b2fdc52db3aa6e8d6210a88e55c6afe19cc710403f95c743158d28a690a871bdc537b33e86449808f78ad8e38e689beb57d6505bf7c14f7cdb31
SSDEEP

1536:8T8qnT8qDqQ8K9MK3tGjbNwPZ6oIeXHWEptp4duRGA:qqMyKdcPeXHWEptpTRG

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2992 2840 WerFault.exe ba565ff6b970cc298347b0c900c3faa474b6aeddab5459cf4d08bfaee75fa26a.exe

pid	pid_target	process	target process
2992	2840	WerFault.exe	ba565ff6b970cc298347b0c900c3faa474b6aeddab5459cf4d08bfaee75fa26a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ba565ff6b970cc298347b0c900c3faa474b6aeddab5459cf4d08bfaee75fa26a.exe

description	pid	process	target process
PID 2840 wrote to memory of 2992	2840	ba565ff6b970cc298347b0c900c3faa474b6aeddab5459cf4d08bfaee75fa26a.exe	WerFault.exe
PID 2840 wrote to memory of 2992	2840	ba565ff6b970cc298347b0c900c3faa474b6aeddab5459cf4d08bfaee75fa26a.exe	WerFault.exe
PID 2840 wrote to memory of 2992	2840	ba565ff6b970cc298347b0c900c3faa474b6aeddab5459cf4d08bfaee75fa26a.exe	WerFault.exe
PID 2840 wrote to memory of 2992	2840	ba565ff6b970cc298347b0c900c3faa474b6aeddab5459cf4d08bfaee75fa26a.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ba565ff6b970cc298347b0c900c3faa474b6aeddab5459cf4d08bfaee75fa26a.exe
"C:\Users\Admin\AppData\Local\Temp\ba565ff6b970cc298347b0c900c3faa474b6aeddab5459cf4d08bfaee75fa26a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 148
2⤵
- Program crash
PID:2992