Analysis
-
max time kernel
135s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 15:58
Behavioral task
behavioral1
Sample
730c002b00490245fd71bf9b522a72c1.exe
Resource
win7-20231129-en
General
-
Target
730c002b00490245fd71bf9b522a72c1.exe
-
Size
3.0MB
-
MD5
730c002b00490245fd71bf9b522a72c1
-
SHA1
d2ec0465e632dda58baba33baaa98ec19c98c442
-
SHA256
5abf8ed5e0a6f61ad3ca9e55e9fc36421188dc7fbdf65a5f7bf44dc40c7b4435
-
SHA512
1e7e0a3c80de47a0f065c75b5c3406d78b565823ce8c1dd11e4d95d5a797826e87f4cdb1a28406f4392346ba548c9ce5991ed7e8fe2fae71bca0ad206638a4ff
-
SSDEEP
49152:+IIOWJvSvy5o9ZxcakLPIXgdfHBL5WEMDBapcakLnx1Ng7Hg76gGD4cakLPIXgdM:+IIOaK65o9ZxcakTOSfx5WEMDBapcak1
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
730c002b00490245fd71bf9b522a72c1.exepid process 4992 730c002b00490245fd71bf9b522a72c1.exe -
Executes dropped EXE 1 IoCs
Processes:
730c002b00490245fd71bf9b522a72c1.exepid process 4992 730c002b00490245fd71bf9b522a72c1.exe -
Processes:
resource yara_rule behavioral2/memory/3448-0-0x0000000000400000-0x000000000065C000-memory.dmp upx behavioral2/memory/4992-14-0x0000000000400000-0x000000000065C000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\730c002b00490245fd71bf9b522a72c1.exe upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
-
Program crash 5 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3832 4992 WerFault.exe 730c002b00490245fd71bf9b522a72c1.exe 412 4992 WerFault.exe 730c002b00490245fd71bf9b522a72c1.exe 4132 4992 WerFault.exe 730c002b00490245fd71bf9b522a72c1.exe 4600 4992 WerFault.exe 730c002b00490245fd71bf9b522a72c1.exe 3468 4992 WerFault.exe 730c002b00490245fd71bf9b522a72c1.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
730c002b00490245fd71bf9b522a72c1.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 730c002b00490245fd71bf9b522a72c1.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 730c002b00490245fd71bf9b522a72c1.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 730c002b00490245fd71bf9b522a72c1.exe Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405 730c002b00490245fd71bf9b522a72c1.exe Set value (data) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f95c0000000100000004000000000800001800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2 730c002b00490245fd71bf9b522a72c1.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
730c002b00490245fd71bf9b522a72c1.exepid process 3448 730c002b00490245fd71bf9b522a72c1.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
730c002b00490245fd71bf9b522a72c1.exe730c002b00490245fd71bf9b522a72c1.exepid process 3448 730c002b00490245fd71bf9b522a72c1.exe 4992 730c002b00490245fd71bf9b522a72c1.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
730c002b00490245fd71bf9b522a72c1.exe730c002b00490245fd71bf9b522a72c1.execmd.exedescription pid process target process PID 3448 wrote to memory of 4992 3448 730c002b00490245fd71bf9b522a72c1.exe 730c002b00490245fd71bf9b522a72c1.exe PID 3448 wrote to memory of 4992 3448 730c002b00490245fd71bf9b522a72c1.exe 730c002b00490245fd71bf9b522a72c1.exe PID 3448 wrote to memory of 4992 3448 730c002b00490245fd71bf9b522a72c1.exe 730c002b00490245fd71bf9b522a72c1.exe PID 4992 wrote to memory of 2312 4992 730c002b00490245fd71bf9b522a72c1.exe schtasks.exe PID 4992 wrote to memory of 2312 4992 730c002b00490245fd71bf9b522a72c1.exe schtasks.exe PID 4992 wrote to memory of 2312 4992 730c002b00490245fd71bf9b522a72c1.exe schtasks.exe PID 4992 wrote to memory of 60 4992 730c002b00490245fd71bf9b522a72c1.exe cmd.exe PID 4992 wrote to memory of 60 4992 730c002b00490245fd71bf9b522a72c1.exe cmd.exe PID 4992 wrote to memory of 60 4992 730c002b00490245fd71bf9b522a72c1.exe cmd.exe PID 60 wrote to memory of 2084 60 cmd.exe schtasks.exe PID 60 wrote to memory of 2084 60 cmd.exe schtasks.exe PID 60 wrote to memory of 2084 60 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\730c002b00490245fd71bf9b522a72c1.exe"C:\Users\Admin\AppData\Local\Temp\730c002b00490245fd71bf9b522a72c1.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\730c002b00490245fd71bf9b522a72c1.exeC:\Users\Admin\AppData\Local\Temp\730c002b00490245fd71bf9b522a72c1.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\730c002b00490245fd71bf9b522a72c1.exe" /TN 1WOV8tOcae1c /F3⤵
- Creates scheduled task(s)
PID:2312 -
C:\Windows\SysWOW64\cmd.execmd.exe /c schtasks.exe /Query /XML /TN 1WOV8tOcae1c > C:\Users\Admin\AppData\Local\Temp\FhkeXQ.xml3⤵
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Query /XML /TN 1WOV8tOcae1c4⤵PID:2084
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 6043⤵
- Program crash
PID:3832 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 6323⤵
- Program crash
PID:412 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 7363⤵
- Program crash
PID:4132 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 7723⤵
- Program crash
PID:4600 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 7803⤵
- Program crash
PID:3468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4992 -ip 49921⤵PID:3660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4992 -ip 49921⤵PID:1820
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4992 -ip 49921⤵PID:5004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4992 -ip 49921⤵PID:4252
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4992 -ip 49921⤵PID:3608
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\730c002b00490245fd71bf9b522a72c1.exeFilesize
298KB
MD598928097a75acb8aed3bbf641317c2f1
SHA1f23e369f624691efa5935078facb6bc98f475e7a
SHA25682140769d1a84c60b6b490f04daf6e25994714030f327d628eb2cc7541bd890e
SHA5120373160b8e18230a098c87629888ac6e24e77b5cdb284b7482452b0d7ce41969c118d7da5339f806a7e8b39a2e3bd5c6d90bb2f2fbcdb077355416e05bc07027
-
C:\Users\Admin\AppData\Local\Temp\FhkeXQ.xmlFilesize
1KB
MD5413a0166b35242102630027008684eeb
SHA1ed678fd5e497894e13fea65d640f883ae533370f
SHA256523b2807141e64f6b4dfe163223fb2cb0db2c8312c01603c5762b64624f0a7be
SHA512b2b4a4cea88cc06933de7f0da3608e97a38267ecf420f2497e0bec3692a27c435a48f6f7efbc6a82e96ae49c41a7db31ade08e862fb6ba0bad4572631c222f3b
-
memory/3448-0-0x0000000000400000-0x000000000065C000-memory.dmpFilesize
2.4MB
-
memory/3448-1-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/3448-2-0x0000000001720000-0x000000000179E000-memory.dmpFilesize
504KB
-
memory/3448-13-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4992-14-0x0000000000400000-0x000000000065C000-memory.dmpFilesize
2.4MB
-
memory/4992-22-0x0000000000470000-0x00000000004DB000-memory.dmpFilesize
428KB
-
memory/4992-21-0x0000000025030000-0x00000000250AE000-memory.dmpFilesize
504KB
-
memory/4992-23-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/4992-40-0x0000000000400000-0x000000000065C000-memory.dmpFilesize
2.4MB