f0ca290a37bdab073602446cb85b0cb50d6a6bec8318cf468fde98b6ea78e185

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
04-08-2023 18:19

Target

2660-56-0x0000000000400000-0x0000000002435000-memory.exe
Size

32.2MB
MD5

ced7aa2146936b864799fc254ff4baf3
SHA1

06c106f179eefdb66e4ab6b349e3ee8a72a6669e
SHA256

f0ca290a37bdab073602446cb85b0cb50d6a6bec8318cf468fde98b6ea78e185
SHA512

ac772e6725e0754140b371dc2d345ede804da2e8656353126be9455116dcb25dece0ade6de386a81a2b075c81e035b329164b6db2ad28b6c7c597a03e3ff86c9
SSDEEP

1536:Cusb7stfbqffbMny0eDEgU5ZOw9mbNFG7x6pt9Dvdp8R+jHb546+qUlE4SJrImJ5:3sbymMy0117esKhpV46+8rawdBqI3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1956	1924	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1956	1924	2660-56-0x0000000000400000-0x0000000002435000-memory.exe	28
PID 1924 wrote to memory of 1956	1924	2660-56-0x0000000000400000-0x0000000002435000-memory.exe	28
PID 1924 wrote to memory of 1956	1924	2660-56-0x0000000000400000-0x0000000002435000-memory.exe	28
PID 1924 wrote to memory of 1956	1924	2660-56-0x0000000000400000-0x0000000002435000-memory.exe	28

C:\Users\Admin\AppData\Local\Temp\2660-56-0x0000000000400000-0x0000000002435000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2660-56-0x0000000000400000-0x0000000002435000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 36
  2⤵
  - Program crash
  PID:1956

memory/1924-54-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download