502c8deb2482c63bfdb3d901261b1b0c6c76ee4255516c217d976e45cf897f17

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18-08-2023 07:30

Target

502c8deb2482c63bfdb3d901261b1b0c6c76ee4255516c217d976e45cf897f17.exe
Size

7KB
MD5

90d424fff7705337a464a444836704e4
SHA1

07378f71f2c240476eb72a928489ea98b5443433
SHA256

502c8deb2482c63bfdb3d901261b1b0c6c76ee4255516c217d976e45cf897f17
SHA512

6f62729cc23e4474195640ee72695629de01c91a9e088f1c8af2707bb7a306cc3488c14809fe9faf2967d316c80e354f2002c77799c4afaa7e0b15a0d61a8ddd
SSDEEP

96:6i3w8vukfXSq4K997q/kYpkOwI9wI+yhndVHIg2KSvELKq2zzNt:RvueX2/kYpm+XEw2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2116	2624	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2116	2624	502c8deb2482c63bfdb3d901261b1b0c6c76ee4255516c217d976e45cf897f17.exe	29
PID 2624 wrote to memory of 2116	2624	502c8deb2482c63bfdb3d901261b1b0c6c76ee4255516c217d976e45cf897f17.exe	29
PID 2624 wrote to memory of 2116	2624	502c8deb2482c63bfdb3d901261b1b0c6c76ee4255516c217d976e45cf897f17.exe	29

C:\Users\Admin\AppData\Local\Temp\502c8deb2482c63bfdb3d901261b1b0c6c76ee4255516c217d976e45cf897f17.exe
"C:\Users\Admin\AppData\Local\Temp\502c8deb2482c63bfdb3d901261b1b0c6c76ee4255516c217d976e45cf897f17.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2624 -s 528
  2⤵
  - Program crash
  PID:2116

memory/2624-54-0x0000000000EA0000-0x0000000000EA8000-memory.dmp

Filesize
32KB

Download
memory/2624-55-0x000007FEF5110000-0x000007FEF5AFC000-memory.dmp

Filesize
9.9MB

Download
memory/2624-56-0x000007FEF5110000-0x000007FEF5AFC000-memory.dmp

Filesize
9.9MB

Download