543e58542d9ef915d631ed599a65375f9c3b2ac543289c7279dc68b6759c992c

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18-02-2024 01:23

Target

543e58542d9ef915d631ed599a65375f9c3b2ac543289c7279dc68b6759c992c.exe
Size

2.2MB
MD5

6c6ca26663c1065e58923aec0852c0cb
SHA1

78eccbc08aec2254788dad4a993b13c21b9b5292
SHA256

543e58542d9ef915d631ed599a65375f9c3b2ac543289c7279dc68b6759c992c
SHA512

2a79781ae179463db5add33fd345c273f914ec4dc2acedaea8da55fb086fda4f73e8ac0376d83459522d4ed8cd7bd0a02cf5d4b5a88f393d1ee31df4b6a91f0e
SSDEEP

24576:3vhzy3cHoORwqetii6hsuiWHBzy3cHoORwqetii6hsuiWUgMASxuTmzkcCy:3GiohGuiohXgSxuTmgc1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2412	2848	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2412	2848	543e58542d9ef915d631ed599a65375f9c3b2ac543289c7279dc68b6759c992c.exe	28
PID 2848 wrote to memory of 2412	2848	543e58542d9ef915d631ed599a65375f9c3b2ac543289c7279dc68b6759c992c.exe	28
PID 2848 wrote to memory of 2412	2848	543e58542d9ef915d631ed599a65375f9c3b2ac543289c7279dc68b6759c992c.exe	28
PID 2848 wrote to memory of 2412	2848	543e58542d9ef915d631ed599a65375f9c3b2ac543289c7279dc68b6759c992c.exe	28

C:\Users\Admin\AppData\Local\Temp\543e58542d9ef915d631ed599a65375f9c3b2ac543289c7279dc68b6759c992c.exe
"C:\Users\Admin\AppData\Local\Temp\543e58542d9ef915d631ed599a65375f9c3b2ac543289c7279dc68b6759c992c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 528
  2⤵
  - Program crash
  PID:2412

memory/2848-1-0x00000000747A0000-0x0000000074E8E000-memory.dmp

Filesize
6.9MB

Download
memory/2848-0-0x0000000000BD0000-0x0000000000E00000-memory.dmp

Filesize
2.2MB

Download
memory/2848-2-0x00000000747A0000-0x0000000074E8E000-memory.dmp

Filesize
6.9MB

Download