0af192da65d4348bb10e1b894026ddeda547d97428ab0a4deb35018383a53d12

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-02-2024 04:53

Target

0af192da65d4348bb10e1b894026ddeda547d97428ab0a4deb35018383a53d12.exe
Size

683KB
MD5

c5a21af99233783e1a05d59d0b7e6edb
SHA1

c5510692665fb48ba40efd2efa8c717626a89f86
SHA256

0af192da65d4348bb10e1b894026ddeda547d97428ab0a4deb35018383a53d12
SHA512

06abe5dc9b7048b9eb4b07780eb109f2507d7aa016ad06ab0bffe726ca04d7dc2c13575eafa3739a1afa3f21ec3cd7a33729683d34f97a319d99b9379a6a498d
SSDEEP

12288:fL5Ujd53LlvIwSMA85nyr0RWH8lHJyJQOSJrcxu65Q6U:f9Ke78PRi8leo6u65

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3032	2696	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 3032	2696	0af192da65d4348bb10e1b894026ddeda547d97428ab0a4deb35018383a53d12.exe	28
PID 2696 wrote to memory of 3032	2696	0af192da65d4348bb10e1b894026ddeda547d97428ab0a4deb35018383a53d12.exe	28
PID 2696 wrote to memory of 3032	2696	0af192da65d4348bb10e1b894026ddeda547d97428ab0a4deb35018383a53d12.exe	28
PID 2696 wrote to memory of 3032	2696	0af192da65d4348bb10e1b894026ddeda547d97428ab0a4deb35018383a53d12.exe	28

C:\Users\Admin\AppData\Local\Temp\0af192da65d4348bb10e1b894026ddeda547d97428ab0a4deb35018383a53d12.exe
"C:\Users\Admin\AppData\Local\Temp\0af192da65d4348bb10e1b894026ddeda547d97428ab0a4deb35018383a53d12.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 688
  2⤵
  - Program crash
  PID:3032

memory/2696-1-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2696-0-0x0000000000CD0000-0x0000000000D80000-memory.dmp

Filesize
704KB

Download
memory/2696-2-0x0000000000590000-0x00000000005D0000-memory.dmp

Filesize
256KB

Download
memory/2696-3-0x0000000000790000-0x00000000007B0000-memory.dmp

Filesize
128KB

Download
memory/2696-4-0x00000000005E0000-0x00000000005EE000-memory.dmp

Filesize
56KB

Download
memory/2696-5-0x00000000009C0000-0x00000000009D2000-memory.dmp

Filesize
72KB

Download
memory/2696-6-0x0000000005260000-0x00000000052E4000-memory.dmp

Filesize
528KB

Download
memory/2696-7-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2696-8-0x0000000000590000-0x00000000005D0000-memory.dmp

Filesize
256KB

Download