b23cb04afe59fee16c95ef5d24a67cb493d4ea88b62f6996e54493548acad6c2

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 15:27

Target

a878fed05519b4e0898e26a79cc646c0bb7b9e380c94f06baecc750f0ab97b99.exe
Size

185KB
MD5

f1dd63587760176e8a57c378ed2113c1
SHA1

21ad96148b4f65bad4d7f28fb422a112c19e9b18
SHA256

a878fed05519b4e0898e26a79cc646c0bb7b9e380c94f06baecc750f0ab97b99
SHA512

9bbafa10779f2d1eb210254d48f2df62cc40fa6445b7a1a6b2d24a485e036098025c0d8cd39524b7fb496f53e31b49f3c0783cf0718e65c99e42685e9379b6ad
SSDEEP

3072:lVnUZh5lgIS4YU3KEvOnEVV5KbHyM+lmsolAIrRuw+mqv9j1MWLQLmbY:lVU35lvS4YiWnEVV0bR+lDAAVb

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2452 828 WerFault.exe a878fed05519b4e0898e26a79cc646c0bb7b9e380c94f06baecc750f0ab97b99.exe

pid	pid_target	process	target process
2452	828	WerFault.exe	a878fed05519b4e0898e26a79cc646c0bb7b9e380c94f06baecc750f0ab97b99.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a878fed05519b4e0898e26a79cc646c0bb7b9e380c94f06baecc750f0ab97b99.exe

description	pid	process	target process
PID 828 wrote to memory of 2452	828	a878fed05519b4e0898e26a79cc646c0bb7b9e380c94f06baecc750f0ab97b99.exe	WerFault.exe
PID 828 wrote to memory of 2452	828	a878fed05519b4e0898e26a79cc646c0bb7b9e380c94f06baecc750f0ab97b99.exe	WerFault.exe
PID 828 wrote to memory of 2452	828	a878fed05519b4e0898e26a79cc646c0bb7b9e380c94f06baecc750f0ab97b99.exe	WerFault.exe
PID 828 wrote to memory of 2452	828	a878fed05519b4e0898e26a79cc646c0bb7b9e380c94f06baecc750f0ab97b99.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a878fed05519b4e0898e26a79cc646c0bb7b9e380c94f06baecc750f0ab97b99.exe
"C:\Users\Admin\AppData\Local\Temp\a878fed05519b4e0898e26a79cc646c0bb7b9e380c94f06baecc750f0ab97b99.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 504
2⤵
- Program crash
PID:2452

memory/828-0-0x00000000000A0000-0x00000000000D4000-memory.dmp

Filesize
208KB

Download
memory/828-1-0x0000000074570000-0x0000000074C5E000-memory.dmp

Filesize
6.9MB

Download
memory/828-2-0x0000000074570000-0x0000000074C5E000-memory.dmp

Filesize
6.9MB

Download