24434396699526114e3c5bff4c577793e880459b488deff4121d34d35e89a9ea

Analysis

max time kernel
42s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 13:24

Target

24434396699526114e3c5bff4c577793e880459b488deff4121d34d35e89a9ea.exe
Size

20KB
MD5

83c442bbf04f6c644d08b188185fdf10
SHA1

31d68c5a17c5cc5e1685abee0322287cc3c610cf
SHA256

24434396699526114e3c5bff4c577793e880459b488deff4121d34d35e89a9ea
SHA512

77f9210147c62825d251ddcb34ba646df51893a82d354cc3cdf191279d9c453061853413ad4d7cc26d39cf910748d2679d0a8e2e891d933ee1bf9f980f4c42d1
SSDEEP

384:dqxhDRnZXdhUdg8iQ7WdFjUVpqta2YlN9gWae5J0pBO/J0:dkhDRHhcg8BhVpAY/rJ+GJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
864	1660	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 864	1660	24434396699526114e3c5bff4c577793e880459b488deff4121d34d35e89a9ea.exe	28
PID 1660 wrote to memory of 864	1660	24434396699526114e3c5bff4c577793e880459b488deff4121d34d35e89a9ea.exe	28
PID 1660 wrote to memory of 864	1660	24434396699526114e3c5bff4c577793e880459b488deff4121d34d35e89a9ea.exe	28
PID 1660 wrote to memory of 864	1660	24434396699526114e3c5bff4c577793e880459b488deff4121d34d35e89a9ea.exe	28

C:\Users\Admin\AppData\Local\Temp\24434396699526114e3c5bff4c577793e880459b488deff4121d34d35e89a9ea.exe
"C:\Users\Admin\AppData\Local\Temp\24434396699526114e3c5bff4c577793e880459b488deff4121d34d35e89a9ea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 116
  2⤵
  - Program crash
  PID:864

memory/864-55-0x0000000000000000-mapping.dmp

Download
memory/1660-54-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/1660-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download