02a77c886241ac268b793beb12742c0b8a2a96097530a255cbe1f2e06d62c5b7

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 16:11

Target

74f08f7cf766e34afcfbeae13dd5142b.exe
Size

368KB
MD5

74f08f7cf766e34afcfbeae13dd5142b
SHA1

9203b9af26b4094586ee6db0060577c65826a632
SHA256

02a77c886241ac268b793beb12742c0b8a2a96097530a255cbe1f2e06d62c5b7
SHA512

c1f74ddf8ee52b57d9caa75b7c204551bf5adc049110c03c648e23fadbf262115b67589632bccceeb7d65fece22e52011d0eb9738fb16226d52fadf3f4c7d128
SSDEEP

6144:RTAp4naqm5GR/0N4Ftn6vicI8qtQQenKDFujBeqSDgzB8jk3z:R041m5Q/0N4L9xYus1NSD2Cg3z

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2896 2808 WerFault.exe 74f08f7cf766e34afcfbeae13dd5142b.exe

pid	pid_target	process	target process
2896	2808	WerFault.exe	74f08f7cf766e34afcfbeae13dd5142b.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

74f08f7cf766e34afcfbeae13dd5142b.exe

description	pid	process	target process
PID 2808 wrote to memory of 2896	2808	74f08f7cf766e34afcfbeae13dd5142b.exe	WerFault.exe
PID 2808 wrote to memory of 2896	2808	74f08f7cf766e34afcfbeae13dd5142b.exe	WerFault.exe
PID 2808 wrote to memory of 2896	2808	74f08f7cf766e34afcfbeae13dd5142b.exe	WerFault.exe
PID 2808 wrote to memory of 2896	2808	74f08f7cf766e34afcfbeae13dd5142b.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\74f08f7cf766e34afcfbeae13dd5142b.exe
"C:\Users\Admin\AppData\Local\Temp\74f08f7cf766e34afcfbeae13dd5142b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 116
2⤵
- Program crash
PID:2896

memory/2808-0-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Filesize
384KB

Download