596263884d5474c2d3bb01238718eb30ce2c8539c99f66fa26b92171c6786c26

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 11:50

Target

lab_samples/b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe
Size

659KB
MD5

b3dc48d13f7d541fa583bf964c0603bf
SHA1

1dbaa68adc0a592508f7ad715bfcdf79c17990d6
SHA256

b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7
SHA512

193bda0656a9d1be54dc655d9af3224ddccb78fc26aa77618fba1e3c36005a0368a200960cc28facc280df667f51a26bbef62282bbf8837cc036a41bfb8525f4
SSDEEP

12288:JR2N+L3K6boxK6dSmiTwntcm3Kbjbgv8YXoNCMF6+yWiL4Wlsfppj4W:P8+L3UM6SIcsHj4N5F6+yW/W4XP

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

760 2464 WerFault.exe b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe

pid	pid_target	process	target process
760	2464	WerFault.exe	b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe

description	pid	process	target process
PID 2464 wrote to memory of 760	2464	b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe	WerFault.exe
PID 2464 wrote to memory of 760	2464	b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe	WerFault.exe
PID 2464 wrote to memory of 760	2464	b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe	WerFault.exe
PID 2464 wrote to memory of 760	2464	b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\lab_samples\b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe
"C:\Users\Admin\AppData\Local\Temp\lab_samples\b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 188
2⤵
- Program crash
PID:760

memory/2464-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2464-1-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/2464-3-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download