e26fabd2c7ff2793a03e50751c6b5c5606cd0dcc9f0fbec237db01080085c327

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 15:01

Target

3bb8a790f7feb85fb0d0f7d2087ce3d7e4eb5577393162c735eec885b66a044e.exe
Size

1.2MB
MD5

f2060efdea36d0b964aacf58232d74c6
SHA1

26c27e2c2f243cab2d85bbd3b4dc8b6f2590daf3
SHA256

3bb8a790f7feb85fb0d0f7d2087ce3d7e4eb5577393162c735eec885b66a044e
SHA512

bb051ac9bb0699feaeab22c94d8ae535ed392dc0aa440907475d421870c5f8f44101dd1ef306ee96946c646814cc6db36e9623ba18ac917c50dcfbf4686abb54
SSDEEP

24576:F9lnCBXoonp1hwCMUkRvWOvqYCZ2ylmJ0H6r:FPRonp1hwCMUkk6pCtlo0ar

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2960	2100	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2960	2100	3bb8a790f7feb85fb0d0f7d2087ce3d7e4eb5577393162c735eec885b66a044e.exe	28
PID 2100 wrote to memory of 2960	2100	3bb8a790f7feb85fb0d0f7d2087ce3d7e4eb5577393162c735eec885b66a044e.exe	28
PID 2100 wrote to memory of 2960	2100	3bb8a790f7feb85fb0d0f7d2087ce3d7e4eb5577393162c735eec885b66a044e.exe	28
PID 2100 wrote to memory of 2960	2100	3bb8a790f7feb85fb0d0f7d2087ce3d7e4eb5577393162c735eec885b66a044e.exe	28

C:\Users\Admin\AppData\Local\Temp\3bb8a790f7feb85fb0d0f7d2087ce3d7e4eb5577393162c735eec885b66a044e.exe
"C:\Users\Admin\AppData\Local\Temp\3bb8a790f7feb85fb0d0f7d2087ce3d7e4eb5577393162c735eec885b66a044e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 116
  2⤵
  - Program crash
  PID:2960

memory/2100-0-0x0000000000274000-0x0000000000275000-memory.dmp

Filesize
4KB

Download