e12463ade721133c16924c31d25c5913ec69985b2e4f2b1a3bde7e68ac3d6e1e

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 16:41

Target

74fe8ce41aab9f40a21ed789e8197e76.exe
Size

95KB
MD5

74fe8ce41aab9f40a21ed789e8197e76
SHA1

c1b7c8938ee80bed6c1ad32393b22ce457f3f771
SHA256

e12463ade721133c16924c31d25c5913ec69985b2e4f2b1a3bde7e68ac3d6e1e
SHA512

3cf914cc05df3851a299c226d6efe69cb0ad478b2d4319027137bdf2d8653def418de036f0ebe4d541f4af6f02de558c303687a073d381ba97f8c1d3f906e4c6
SSDEEP

1536:WRpxjwHLtCqOh2bNsMFOgjg557G53gBvTlVk3IzAGannA2Uxzk:W/xjwMP2bugOQg5k3v0

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1732 1812 WerFault.exe 74fe8ce41aab9f40a21ed789e8197e76.exe

pid	pid_target	process	target process
1732	1812	WerFault.exe	74fe8ce41aab9f40a21ed789e8197e76.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

74fe8ce41aab9f40a21ed789e8197e76.exe

description	pid	process	target process
PID 1812 wrote to memory of 1732	1812	74fe8ce41aab9f40a21ed789e8197e76.exe	WerFault.exe
PID 1812 wrote to memory of 1732	1812	74fe8ce41aab9f40a21ed789e8197e76.exe	WerFault.exe
PID 1812 wrote to memory of 1732	1812	74fe8ce41aab9f40a21ed789e8197e76.exe	WerFault.exe
PID 1812 wrote to memory of 1732	1812	74fe8ce41aab9f40a21ed789e8197e76.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\74fe8ce41aab9f40a21ed789e8197e76.exe
"C:\Users\Admin\AppData\Local\Temp\74fe8ce41aab9f40a21ed789e8197e76.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 36
2⤵
- Program crash
PID:1732

memory/1812-0-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download