e529d736eb5d661cbdc62f88f50461d736686bb2aa31fb28a5412d59e4c81bc4

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-02-2024 06:45

Target

ab425bf1f9965f054ee0400007e4c28a.exe
Size

1.1MB
MD5

ab425bf1f9965f054ee0400007e4c28a
SHA1

10c79c14e1e050ff2fb14d4d3470b763a7c2c541
SHA256

e529d736eb5d661cbdc62f88f50461d736686bb2aa31fb28a5412d59e4c81bc4
SHA512

cc6159fe281aab2a5c9bbaa91feb4844e630bd37434bd96a7811155a7ebbb9ef801c959b3bf874b9275d7dba3a97f41e0804040fa77bedc835d4e12c0e0d625e
SSDEEP

12288:2oKboJfbmpMC3y50ysABr54bCRPZr5ZU0ZG+wksmB4C:2oKAfipMCC2dABtRRNnwFC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2328	3044	WerFault.exe	16

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 488	3044	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 3044 wrote to memory of 488	3044	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 3044 wrote to memory of 488	3044	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 3044 wrote to memory of 488	3044	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 3044 wrote to memory of 488	3044	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 3044 wrote to memory of 488	3044	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 3044 wrote to memory of 488	3044	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 3044 wrote to memory of 488	3044	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 3044 wrote to memory of 488	3044	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 3044 wrote to memory of 488	3044	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 3044 wrote to memory of 488	3044	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 3044 wrote to memory of 488	3044	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 3044 wrote to memory of 488	3044	ab425bf1f9965f054ee0400007e4c28a.exe	30
PID 3044 wrote to memory of 2328	3044	ab425bf1f9965f054ee0400007e4c28a.exe	31
PID 3044 wrote to memory of 2328	3044	ab425bf1f9965f054ee0400007e4c28a.exe	31
PID 3044 wrote to memory of 2328	3044	ab425bf1f9965f054ee0400007e4c28a.exe	31
PID 3044 wrote to memory of 2328	3044	ab425bf1f9965f054ee0400007e4c28a.exe	31

C:\Users\Admin\AppData\Local\Temp\ab425bf1f9965f054ee0400007e4c28a.exe
"C:\Users\Admin\AppData\Local\Temp\ab425bf1f9965f054ee0400007e4c28a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  2⤵
  PID:488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 1792
  2⤵
  - Program crash
  PID:2328

memory/3044-0-0x0000000000100000-0x000000000021A000-memory.dmp

Filesize
1.1MB

Download
memory/3044-1-0x0000000074150000-0x000000007483E000-memory.dmp

Filesize
6.9MB

Download
memory/3044-2-0x0000000004300000-0x0000000004340000-memory.dmp

Filesize
256KB

Download
memory/3044-3-0x0000000000460000-0x0000000000474000-memory.dmp

Filesize
80KB

Download
memory/3044-4-0x0000000074150000-0x000000007483E000-memory.dmp

Filesize
6.9MB

Download
memory/3044-5-0x0000000004300000-0x0000000004340000-memory.dmp

Filesize
256KB

Download