c074edb4c9c21835b60985938aca7fae6e10151580d31d2e155105e0406616fa

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 21:06

Target

519e2fdccfcb4bc74bc7bbbf6cf2a566.exe
Size

64KB
MD5

519e2fdccfcb4bc74bc7bbbf6cf2a566
SHA1

408421867276cb4996cc39db6481fa53dc637648
SHA256

c074edb4c9c21835b60985938aca7fae6e10151580d31d2e155105e0406616fa
SHA512

f7ebde10cc1d74db0c9d8bfe72bb06b7f0a5ac892a734b94cd02b7a4cf6e31d0a445adbae383a4b19ea6f71901f60ce8bd463a3a1cd54a5e387ff31aa9c0a228
SSDEEP

768:OsE8vJnhBqTaGw91w3O7PM0+YsBrdKregzTOVSL2p/1H54XdnhaBGHBJ1nVql3PV:xBqTan1w3O7k0+YMLw2LEsBMu/H1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2800	880	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 2800	880	519e2fdccfcb4bc74bc7bbbf6cf2a566.exe	28
PID 880 wrote to memory of 2800	880	519e2fdccfcb4bc74bc7bbbf6cf2a566.exe	28
PID 880 wrote to memory of 2800	880	519e2fdccfcb4bc74bc7bbbf6cf2a566.exe	28
PID 880 wrote to memory of 2800	880	519e2fdccfcb4bc74bc7bbbf6cf2a566.exe	28

C:\Users\Admin\AppData\Local\Temp\519e2fdccfcb4bc74bc7bbbf6cf2a566.exe
"C:\Users\Admin\AppData\Local\Temp\519e2fdccfcb4bc74bc7bbbf6cf2a566.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 140
  2⤵
  - Program crash
  PID:2800

memory/880-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/880-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download