1f92c15704b8a0b21f36570633470e0b84d0f11c31dce98c2b4239d5f5083e43

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/03/2024, 17:26

Target

300-59-0x0000000000400000-0x000000000041D000-memory.exe
Size

116KB
MD5

ce6badaafe3fa625f3661bb91d73d966
SHA1

a1ad9061c808377ea2c7e85a53370dea65a0674b
SHA256

1f92c15704b8a0b21f36570633470e0b84d0f11c31dce98c2b4239d5f5083e43
SHA512

b69f1df5572a0426e7c758d6d9eaafef6629cac8fefd40e980a82cb391a12a196c22b79d04e7e4c18c632a0b3f607e3ac7748c5d370e861e92a43d41d9ad75fa
SSDEEP

1536:Bpaiq0I2XvL/5kVvpyITHAOEH8pIZ+msXvsfJre8oJ1C:BpaikE/5SppIZ+m2sfJrebJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1968	3060	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 1968	3060	300-59-0x0000000000400000-0x000000000041D000-memory.exe	28
PID 3060 wrote to memory of 1968	3060	300-59-0x0000000000400000-0x000000000041D000-memory.exe	28
PID 3060 wrote to memory of 1968	3060	300-59-0x0000000000400000-0x000000000041D000-memory.exe	28
PID 3060 wrote to memory of 1968	3060	300-59-0x0000000000400000-0x000000000041D000-memory.exe	28

C:\Users\Admin\AppData\Local\Temp\300-59-0x0000000000400000-0x000000000041D000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\300-59-0x0000000000400000-0x000000000041D000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 36
  2⤵
  - Program crash
  PID:1968