5a71b92d9d691754a5ff056b7d4aa819e26f2e55485d17623c5be00e431d91f8

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 00:27

Target

94411f0873e6410d644c8a630ffbdf387639fab05fbcda468a343ff3b5db246f_dump.bin.exe
Size

38KB
MD5

7732d02d81d8c0b5b22cd6eab1b754f6
SHA1

490743abb712f9875b9146e398a9e1b85ec84438
SHA256

5a71b92d9d691754a5ff056b7d4aa819e26f2e55485d17623c5be00e431d91f8
SHA512

d6e657d4824a4d79e771c3ec20006a216c4e25b47c2d9cdf230bc71973fd7fb0ec965aac8568f226d59d55dfe5705866b3f6e6b9e7d5d872afe15b2a96a77f19
SSDEEP

768:3yyQXfpwh0ZOds/5EXv2C54NbptaDL0grngoZHYgXLBYfUV:3y9fpvZOdsx2v2+4b/aDLDrnpYgXLKf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2512	1964	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2512	1964	94411f0873e6410d644c8a630ffbdf387639fab05fbcda468a343ff3b5db246f_dump.bin.exe	28
PID 1964 wrote to memory of 2512	1964	94411f0873e6410d644c8a630ffbdf387639fab05fbcda468a343ff3b5db246f_dump.bin.exe	28
PID 1964 wrote to memory of 2512	1964	94411f0873e6410d644c8a630ffbdf387639fab05fbcda468a343ff3b5db246f_dump.bin.exe	28
PID 1964 wrote to memory of 2512	1964	94411f0873e6410d644c8a630ffbdf387639fab05fbcda468a343ff3b5db246f_dump.bin.exe	28

C:\Users\Admin\AppData\Local\Temp\94411f0873e6410d644c8a630ffbdf387639fab05fbcda468a343ff3b5db246f_dump.bin.exe
"C:\Users\Admin\AppData\Local\Temp\94411f0873e6410d644c8a630ffbdf387639fab05fbcda468a343ff3b5db246f_dump.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 104
  2⤵
  - Program crash
  PID:2512