02f3ac30922571d3ea08c4207dfb7073d0a30cbc67b5627b4a66a56311e09ff5

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 02:21

Target

02f3ac30922571d3ea08c4207dfb7073d0a30cbc67b5627b4a66a56311e09ff5.exe
Size

67.7MB
MD5

5d235d6267336aa51184b28d6d0ac6dc
SHA1

0a750a852a566dbf2ccbda66a11332784da26d7f
SHA256

02f3ac30922571d3ea08c4207dfb7073d0a30cbc67b5627b4a66a56311e09ff5
SHA512

b8c104247430b137a25d271aa5524d8423866794b458a9183773f438de92787781b343a386ef8dbe6bcc0a29360071b9dfbf3fa9afd7e5eb9da667b8f5dbe217
SSDEEP

786432:y+jLAJNIndudu80sv1vJ1HoA5AKF7zR/t6tKF+iSpl5gtD8Ko2d:Dj0JNmHPs9VAMzttZmpl+twId

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2884	3000	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2884	3000	02f3ac30922571d3ea08c4207dfb7073d0a30cbc67b5627b4a66a56311e09ff5.exe	29
PID 3000 wrote to memory of 2884	3000	02f3ac30922571d3ea08c4207dfb7073d0a30cbc67b5627b4a66a56311e09ff5.exe	29
PID 3000 wrote to memory of 2884	3000	02f3ac30922571d3ea08c4207dfb7073d0a30cbc67b5627b4a66a56311e09ff5.exe	29
PID 3000 wrote to memory of 2884	3000	02f3ac30922571d3ea08c4207dfb7073d0a30cbc67b5627b4a66a56311e09ff5.exe	29

C:\Users\Admin\AppData\Local\Temp\02f3ac30922571d3ea08c4207dfb7073d0a30cbc67b5627b4a66a56311e09ff5.exe
"C:\Users\Admin\AppData\Local\Temp\02f3ac30922571d3ea08c4207dfb7073d0a30cbc67b5627b4a66a56311e09ff5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 96
  2⤵
  - Program crash
  PID:2884

memory/3000-0-0x00000000000E0000-0x0000000000177000-memory.dmp

Filesize
604KB

Download
memory/3000-5-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download