6e1e79929fc15516775cf2e8ba323b7bbf1b38e6e6b18cea1add4d1447c08ed1

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 00:31

Target
7493e5079e530d9c43b313013a4a7b7a.bin.exe
Size 46KB
Sample240526-at25eagb21
SHA256 6e1e79929fc15516775cf2e8ba323b7bbf1b38e6e6b18cea1add4d1447c08ed1
MD5 7493e5079e530d9c43b313013a4a7b7a
SHA1 539f57eaaeb0744ca27d07b3674ea65ef2e5acfc
SHA512 24e777087cf1ff90719587d028c69104a720070ac02c062a3c172354969e9b11978155547dd64ea16dbae0cfcff6eca084cbffdeb4fb96e9c65e0fb5a05ac535
SSDEEP 768:IUnSAvu6cMEtClbx0mz6Qoo3SJ0GebDnVR8WIisfp381c/Llf9FQ15qxtbR3LDBe:PnhvuqmQ0m2QOuXfA1L38OjUExtbtK6
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2472	1924	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2472	1924	7493e5079e530d9c43b313013a4a7b7a.bin.exe	28
PID 1924 wrote to memory of 2472	1924	7493e5079e530d9c43b313013a4a7b7a.bin.exe	28
PID 1924 wrote to memory of 2472	1924	7493e5079e530d9c43b313013a4a7b7a.bin.exe	28
PID 1924 wrote to memory of 2472	1924	7493e5079e530d9c43b313013a4a7b7a.bin.exe	28

C:\Users\Admin\AppData\Local\Temp\7493e5079e530d9c43b313013a4a7b7a.bin.exe
"C:\Users\Admin\AppData\Local\Temp\7493e5079e530d9c43b313013a4a7b7a.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 36
  2⤵
  - Program crash
  PID:2472

memory/1924-0-0x0000000000400000-0x0000000000425000-memory.dmp

Download