83accd1cbe7ed2c6db27dcc000e940ab475b40dec95847779cc47905aaa909ea

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/04/2024, 09:21

Sharing

Target
out.exe
Size 986KB
Sample240413-lbdvmsfe71
SHA256 0154ba026bf77b2a782af5684118f0676cbe72ab784c43a898c585e8f42b3d0d
MD5 feb7d24f344b09e79161b8a500c55df0
SHA1 2b8c74e4ad71335ff88b04aca9ac878201f73134
SHA512 464cc7e52063507dbb0780f784a93d490aaddcf2047acf557e7376c297e0e618b98240361cc290a50854717bb562e5a419e84e1e633e149a4a02c63a657d6697
SSDEEP 3072:i7xOwLvY3cqd3d0djaas0G22rlFPIS2JY6kkI9MsomUTVlowUTyY+DGSb36ESb/Y:i7xdLvUcigjLGRfPYJ6NqP
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1672	2216	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 1672	2216	out.exe	28
PID 2216 wrote to memory of 1672	2216	out.exe	28
PID 2216 wrote to memory of 1672	2216	out.exe	28
PID 2216 wrote to memory of 1672	2216	out.exe	28

C:\Users\Admin\AppData\Local\Temp\out.exe
"C:\Users\Admin\AppData\Local\Temp\out.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 36
  2⤵
  - Program crash
  PID:1672