1380191df41abee1168f5fbb56e2a2f2384ff432acbcdf92b19fec13740af5d0

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03-03-2024 21:41

Target

2464-303-0x0000000000400000-0x000000000046C000-memory.exe
Size

432KB
MD5

834820edb90b5dabbe71ab65d2c94588
SHA1

4c6794bb99f53b97bf5b5fadcea305dd9c6d0156
SHA256

1380191df41abee1168f5fbb56e2a2f2384ff432acbcdf92b19fec13740af5d0
SHA512

e67b0394e5f5f5aaebca2c30516ce4192c3f3dac92297fb202e28db0b75ddd399d29fd264194266f061043f56765b0b922a0ff1f035f0a89a49e3ed1c2506187
SSDEEP

6144:7uQRHexuieV+IiVN3f9MY8DWGUQOElBtObJV9DKhoCYLItjCNhuC:7uQRHexuieQ/EbYbxDKKtItjCK

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3036 2360 WerFault.exe 2464-303-0x0000000000400000-0x000000000046C000-memory.exe

pid	pid_target	process	target process
3036	2360	WerFault.exe	2464-303-0x0000000000400000-0x000000000046C000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2464-303-0x0000000000400000-0x000000000046C000-memory.exe

description	pid	process	target process
PID 2360 wrote to memory of 3036	2360	2464-303-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 2360 wrote to memory of 3036	2360	2464-303-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 2360 wrote to memory of 3036	2360	2464-303-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 2360 wrote to memory of 3036	2360	2464-303-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2464-303-0x0000000000400000-0x000000000046C000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2464-303-0x0000000000400000-0x000000000046C000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 36
2⤵
- Program crash
PID:3036