d53bda0838a3db470a20a273d1effee7ef42bbc0a337fbb65eddfe079a5d0206

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/04/2024, 00:47

Target
e3df75b478f43b2bc1178c59351f131d.bin.exe
Size 51KB
Sample240424-a47smsdc48
SHA256 d53bda0838a3db470a20a273d1effee7ef42bbc0a337fbb65eddfe079a5d0206
MD5 e3df75b478f43b2bc1178c59351f131d
SHA1 1a1292b2d9413b211b288f754eab30b38d31e3bf
SHA512 e5c28fef2c8eb9edf55dc8f054645311872217c397c69cce2f52818f679238ee445ebf512344838a7e35b27c57e0aaff498e9a9c8743bc26a0b9360c5b264556
SSDEEP 1536:Iv7qsuoozpxPK8nlcNjmBXBchp8kSCxPxf:9CgPJihTPxf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2352	2044	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2352	2044	e3df75b478f43b2bc1178c59351f131d.bin.exe	28
PID 2044 wrote to memory of 2352	2044	e3df75b478f43b2bc1178c59351f131d.bin.exe	28
PID 2044 wrote to memory of 2352	2044	e3df75b478f43b2bc1178c59351f131d.bin.exe	28
PID 2044 wrote to memory of 2352	2044	e3df75b478f43b2bc1178c59351f131d.bin.exe	28

C:\Users\Admin\AppData\Local\Temp\e3df75b478f43b2bc1178c59351f131d.bin.exe
"C:\Users\Admin\AppData\Local\Temp\e3df75b478f43b2bc1178c59351f131d.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 36
  2⤵
  - Program crash
  PID:2352

memory/2044-0-0x0000000000400000-0x0000000000426297-memory.dmp

Download