4aebbb23d160253876cc3a93c7cc31ed0c48645ae04070345bb5933ed4efee04

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 11:20

Target

b9493d5cc0930bdb4d765895c7f96f17a60376cf6cb7c307d5ce109cdf2f739a.exe
Size

230KB
MD5

06bed703d447c629f04ebc44a2286847
SHA1

e80a2cfd33a52acc2c7ffb03ab32e8ff25cce28f
SHA256

b9493d5cc0930bdb4d765895c7f96f17a60376cf6cb7c307d5ce109cdf2f739a
SHA512

88aeaca5f59a919caa71a1a046fa2c0d189cb50a43b435775a66648d7a4707904932607cdaf0b31f6e4f4a76b33117d064319bb9acebb705b1a907d47f75e0b0
SSDEEP

6144:3fqzOQ5ZB35YbVGqe4QmYrZGPKliFAW4pv:3fqzF31q/QLLcz4pv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2956	2860	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2956	2860	b9493d5cc0930bdb4d765895c7f96f17a60376cf6cb7c307d5ce109cdf2f739a.exe	29
PID 2860 wrote to memory of 2956	2860	b9493d5cc0930bdb4d765895c7f96f17a60376cf6cb7c307d5ce109cdf2f739a.exe	29
PID 2860 wrote to memory of 2956	2860	b9493d5cc0930bdb4d765895c7f96f17a60376cf6cb7c307d5ce109cdf2f739a.exe	29
PID 2860 wrote to memory of 2956	2860	b9493d5cc0930bdb4d765895c7f96f17a60376cf6cb7c307d5ce109cdf2f739a.exe	29

C:\Users\Admin\AppData\Local\Temp\b9493d5cc0930bdb4d765895c7f96f17a60376cf6cb7c307d5ce109cdf2f739a.exe
"C:\Users\Admin\AppData\Local\Temp\b9493d5cc0930bdb4d765895c7f96f17a60376cf6cb7c307d5ce109cdf2f739a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 92
  2⤵
  - Program crash
  PID:2956

memory/2860-0-0x0000000001266000-0x0000000001268000-memory.dmp

Filesize
8KB

Download