71fd3a87be81c234e60aa4fef6e942209c8478d1e75fa73fa48338c1b4414585

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 23:14

Target

ff2be5c3b229cf96e60b39bce28cef5c.exe
Size

29KB
MD5

ff2be5c3b229cf96e60b39bce28cef5c
SHA1

84d44eed116f1f8852e3546e7fd291f8ab7f0a58
SHA256

71fd3a87be81c234e60aa4fef6e942209c8478d1e75fa73fa48338c1b4414585
SHA512

3adba1b706bc165e20c4273925a60c568991b31156ad6fb1f59ecf54df31e79df65fd89d1346ef7c5dd801d6e79503ef55aef14468c31890460b7cc061828ffd
SSDEEP

384:7z/0RPIvpLhgi8G9OgeNK/jYuP3J4V2sidokno7iEMuX/xfTFhpUkjBUy8l3D+:XmP41hgejl3ZdrLel8l3D

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3004 1912 WerFault.exe ff2be5c3b229cf96e60b39bce28cef5c.exe

pid	pid_target	process	target process
3004	1912	WerFault.exe	ff2be5c3b229cf96e60b39bce28cef5c.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ff2be5c3b229cf96e60b39bce28cef5c.exe

description	pid	process	target process
PID 1912 wrote to memory of 3004	1912	ff2be5c3b229cf96e60b39bce28cef5c.exe	WerFault.exe
PID 1912 wrote to memory of 3004	1912	ff2be5c3b229cf96e60b39bce28cef5c.exe	WerFault.exe
PID 1912 wrote to memory of 3004	1912	ff2be5c3b229cf96e60b39bce28cef5c.exe	WerFault.exe
PID 1912 wrote to memory of 3004	1912	ff2be5c3b229cf96e60b39bce28cef5c.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ff2be5c3b229cf96e60b39bce28cef5c.exe
"C:\Users\Admin\AppData\Local\Temp\ff2be5c3b229cf96e60b39bce28cef5c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 160
2⤵
- Program crash
PID:3004

memory/1912-3-0x0000000000220000-0x0000000000250000-memory.dmp

Filesize
192KB

Download
memory/1912-2-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1912-1-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1912-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download