00b485c67c728da7eb09f08e06be945440dc91ee74a5f0d8d38df055eb2d2ed6

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
31-10-2023 13:56

Target

6395e697e46dcfefff4dbf33af40edfb2b974e095e3a4ce251e190c05d17594d.exe
Size

164KB
MD5

b4a80cf5e0c4fddb6aa9f94dd6d12132
SHA1

0372e50f4be9e657d073f6bf3ad65c2ce82ea833
SHA256

6395e697e46dcfefff4dbf33af40edfb2b974e095e3a4ce251e190c05d17594d
SHA512

c4afb1bfe99d6bd9087530d892dafb2c01d12837dcc9643749cae8ddd8fd67bd2cf089504a1c5479ab9f244ff4a413bc1e656e4e88ba4f3384f5a205e8ec978b
SSDEEP

3072:4z8Zta5LIiEstvmjVTDaXjDbhP5Wy7Jj8GJTNGyJapQ5yG8MUUsks2ns5:vta5LuSvemXjDDWwh8GJTNpMG5Pp1hs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2212	2936	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2212	2936	6395e697e46dcfefff4dbf33af40edfb2b974e095e3a4ce251e190c05d17594d.exe	28
PID 2936 wrote to memory of 2212	2936	6395e697e46dcfefff4dbf33af40edfb2b974e095e3a4ce251e190c05d17594d.exe	28
PID 2936 wrote to memory of 2212	2936	6395e697e46dcfefff4dbf33af40edfb2b974e095e3a4ce251e190c05d17594d.exe	28
PID 2936 wrote to memory of 2212	2936	6395e697e46dcfefff4dbf33af40edfb2b974e095e3a4ce251e190c05d17594d.exe	28

C:\Users\Admin\AppData\Local\Temp\6395e697e46dcfefff4dbf33af40edfb2b974e095e3a4ce251e190c05d17594d.exe
"C:\Users\Admin\AppData\Local\Temp\6395e697e46dcfefff4dbf33af40edfb2b974e095e3a4ce251e190c05d17594d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 388
  2⤵
  - Program crash
  PID:2212

memory/2936-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2936-1-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2936-2-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download