b23cb04afe59fee16c95ef5d24a67cb493d4ea88b62f6996e54493548acad6c2

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 15:27

Target

3643464a225aa2ad5c9c9657d4fd05b943fdd9c04ca36b9d3610a04332909d19.exe
Size

187KB
MD5

5239186df089b14d776b1438bc495878
SHA1

40a0689b89576ce865f3b5eddb18acb679219704
SHA256

3643464a225aa2ad5c9c9657d4fd05b943fdd9c04ca36b9d3610a04332909d19
SHA512

eb235607d70e70cc5eea1102582b599ec483aee5b8fdb8dd6524952230746bfefa5316bf31c78eee43e9d61bd6736cc973f8c45cbd175ae93bc960f10cb2a3da
SSDEEP

1536:giTQB4GEf+C6P7Pr/yIcavDI47BHs7E5FGcAfKYelzgvf5nBbN+JRiHZ/niduyZx:g3B4/WC6P77yIlJdR20UBY5duyKp5c

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2708 1064 WerFault.exe 3643464a225aa2ad5c9c9657d4fd05b943fdd9c04ca36b9d3610a04332909d19.exe

pid	pid_target	process	target process
2708	1064	WerFault.exe	3643464a225aa2ad5c9c9657d4fd05b943fdd9c04ca36b9d3610a04332909d19.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3643464a225aa2ad5c9c9657d4fd05b943fdd9c04ca36b9d3610a04332909d19.exe

description	pid	process	target process
PID 1064 wrote to memory of 2708	1064	3643464a225aa2ad5c9c9657d4fd05b943fdd9c04ca36b9d3610a04332909d19.exe	WerFault.exe
PID 1064 wrote to memory of 2708	1064	3643464a225aa2ad5c9c9657d4fd05b943fdd9c04ca36b9d3610a04332909d19.exe	WerFault.exe
PID 1064 wrote to memory of 2708	1064	3643464a225aa2ad5c9c9657d4fd05b943fdd9c04ca36b9d3610a04332909d19.exe	WerFault.exe
PID 1064 wrote to memory of 2708	1064	3643464a225aa2ad5c9c9657d4fd05b943fdd9c04ca36b9d3610a04332909d19.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3643464a225aa2ad5c9c9657d4fd05b943fdd9c04ca36b9d3610a04332909d19.exe
"C:\Users\Admin\AppData\Local\Temp\3643464a225aa2ad5c9c9657d4fd05b943fdd9c04ca36b9d3610a04332909d19.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 632
2⤵
- Program crash
PID:2708

memory/1064-0-0x0000000000CD0000-0x0000000000D04000-memory.dmp

Filesize
208KB

Download
memory/1064-1-0x0000000074C50000-0x000000007533E000-memory.dmp

Filesize
6.9MB

Download
memory/1064-2-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

Filesize
256KB

Download
memory/1064-3-0x0000000074C50000-0x000000007533E000-memory.dmp

Filesize
6.9MB

Download
memory/1064-4-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

Filesize
256KB

Download