97b6712b70b2de7ac0ba19c29c64244a34b3b9a3c03f8084df158f8de5c8eab7

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-02-2024 01:41

Target

97b6712b70b2de7ac0ba19c29c64244a34b3b9a3c03f8084df158f8de5c8eab7.exe
Size

2.7MB
MD5

de3532c784940a394fdb8ff4d4018283
SHA1

892af9c94d65d9458d197d9c890bb292fb8c59ea
SHA256

97b6712b70b2de7ac0ba19c29c64244a34b3b9a3c03f8084df158f8de5c8eab7
SHA512

89cb408b2e2542c8aae6f7da1115bb4d1ebeb9f44042d7788f76e1b367fb6bd9e4670e68107ff82772534d05d31f135e64d257c90ba29a9d8d161ffc9deecf08
SSDEEP

24576:q/sn9+gS6uHk1U4+E+hzy3cHoORwqetii6hsuiWKIkNPI66lXSc:7LS6uH8UXEHiohlf6A

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2792 2908 WerFault.exe 97b6712b70b2de7ac0ba19c29c64244a34b3b9a3c03f8084df158f8de5c8eab7.exe

pid	pid_target	process	target process
2792	2908	WerFault.exe	97b6712b70b2de7ac0ba19c29c64244a34b3b9a3c03f8084df158f8de5c8eab7.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

97b6712b70b2de7ac0ba19c29c64244a34b3b9a3c03f8084df158f8de5c8eab7.exe

description	pid	process	target process
PID 2908 wrote to memory of 2792	2908	97b6712b70b2de7ac0ba19c29c64244a34b3b9a3c03f8084df158f8de5c8eab7.exe	WerFault.exe
PID 2908 wrote to memory of 2792	2908	97b6712b70b2de7ac0ba19c29c64244a34b3b9a3c03f8084df158f8de5c8eab7.exe	WerFault.exe
PID 2908 wrote to memory of 2792	2908	97b6712b70b2de7ac0ba19c29c64244a34b3b9a3c03f8084df158f8de5c8eab7.exe	WerFault.exe
PID 2908 wrote to memory of 2792	2908	97b6712b70b2de7ac0ba19c29c64244a34b3b9a3c03f8084df158f8de5c8eab7.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\97b6712b70b2de7ac0ba19c29c64244a34b3b9a3c03f8084df158f8de5c8eab7.exe
"C:\Users\Admin\AppData\Local\Temp\97b6712b70b2de7ac0ba19c29c64244a34b3b9a3c03f8084df158f8de5c8eab7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 552
2⤵
- Program crash
PID:2792

memory/2908-0-0x0000000000B50000-0x0000000000E04000-memory.dmp

Filesize
2.7MB

Download
memory/2908-1-0x00000000746C0000-0x0000000074DAE000-memory.dmp

Filesize
6.9MB

Download
memory/2908-2-0x00000000746C0000-0x0000000074DAE000-memory.dmp

Filesize
6.9MB

Download