bac6b27d4aab38079960ef09259879758ba52649ba48ab2f77712732b2dbf56e

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:24

Target

bac6b27d4aab38079960ef09259879758ba52649ba48ab2f77712732b2dbf56e.exe
Size

868KB
MD5

2b08df2bd42a37163edc97bf263b1282
SHA1

11e0a90e385756e660c286c07c28c275feeeeb5a
SHA256

bac6b27d4aab38079960ef09259879758ba52649ba48ab2f77712732b2dbf56e
SHA512

8c927933829dc6f3e7dcbc4beb4ba0dfe1c689e7ef0d6f06461fe19ee72a586ce5ed2ba88de93e74faaa157c1563d74428d114e63a38c389e290495348a1cef5
SSDEEP

12288:liMqnyL87Fh9k+kzl6S01rIn3/de8iUJZJcbADgZse7bl3B:in7Fh9qp6S09Ue8iUJZ7i7BR

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1840 1844 WerFault.exe bac6b27d4aab38079960ef09259879758ba52649ba48ab2f77712732b2dbf56e.exe

pid	pid_target	process	target process
1840	1844	WerFault.exe	bac6b27d4aab38079960ef09259879758ba52649ba48ab2f77712732b2dbf56e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bac6b27d4aab38079960ef09259879758ba52649ba48ab2f77712732b2dbf56e.exe

description	pid	process	target process
PID 1844 wrote to memory of 1840	1844	bac6b27d4aab38079960ef09259879758ba52649ba48ab2f77712732b2dbf56e.exe	WerFault.exe
PID 1844 wrote to memory of 1840	1844	bac6b27d4aab38079960ef09259879758ba52649ba48ab2f77712732b2dbf56e.exe	WerFault.exe
PID 1844 wrote to memory of 1840	1844	bac6b27d4aab38079960ef09259879758ba52649ba48ab2f77712732b2dbf56e.exe	WerFault.exe
PID 1844 wrote to memory of 1840	1844	bac6b27d4aab38079960ef09259879758ba52649ba48ab2f77712732b2dbf56e.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bac6b27d4aab38079960ef09259879758ba52649ba48ab2f77712732b2dbf56e.exe
"C:\Users\Admin\AppData\Local\Temp\bac6b27d4aab38079960ef09259879758ba52649ba48ab2f77712732b2dbf56e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 208
  2⤵
  - Program crash
  PID:1840