eaeff67ec779d38ad8e79c2b161ea1bdc5bc2740dd247ccd89e67c26ccf67adb

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/02/2024, 03:26

Target

5e058c313a97c5bd3122e8554f9217e18e1c879d72d9f0f5df985f7ff3827d5f.exe
Size

606KB
MD5

9f797f1d099263ff19b2aecd09707080
SHA1

da96cf4bc56816aab63ad8cd8613f03a4b2a8555
SHA256

5e058c313a97c5bd3122e8554f9217e18e1c879d72d9f0f5df985f7ff3827d5f
SHA512

2e210a3f6ea006847d18863286d2823dd98963b3470ad57ceeae49f22caab2b72db6aa82fe7fea5adcd23cee7f6768da00c0c304ae6e50fed5ec4d182010c72e
SSDEEP

12288:T8voyMkzQD5w92uPFSfleaq9ffGuYFs89u0Yf1cHQVw3eia99a9i:TRkzQRuEfleaSWuYf9u0YfIQVw3OyY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2724	2988	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2724	2988	5e058c313a97c5bd3122e8554f9217e18e1c879d72d9f0f5df985f7ff3827d5f.exe	29
PID 2988 wrote to memory of 2724	2988	5e058c313a97c5bd3122e8554f9217e18e1c879d72d9f0f5df985f7ff3827d5f.exe	29
PID 2988 wrote to memory of 2724	2988	5e058c313a97c5bd3122e8554f9217e18e1c879d72d9f0f5df985f7ff3827d5f.exe	29
PID 2988 wrote to memory of 2724	2988	5e058c313a97c5bd3122e8554f9217e18e1c879d72d9f0f5df985f7ff3827d5f.exe	29

C:\Users\Admin\AppData\Local\Temp\5e058c313a97c5bd3122e8554f9217e18e1c879d72d9f0f5df985f7ff3827d5f.exe
"C:\Users\Admin\AppData\Local\Temp\5e058c313a97c5bd3122e8554f9217e18e1c879d72d9f0f5df985f7ff3827d5f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 96
  2⤵
  - Program crash
  PID:2724

memory/2988-0-0x0000000000510000-0x000000000058C000-memory.dmp

Filesize
496KB

Download
memory/2988-5-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download