6f196c49ffd796235ba71147d57693abf690ed3524ee8afb24dab967b5fea287

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-03-2024 20:17

Target

1144-224-0x00000000008E0000-0x000000000094D000-memory.exe
Size

436KB
MD5

c7bf913d52f8a6f5a53028ad3b5764c3
SHA1

67f5ddf2264085aab2b00567ad1ba22f81bdbada
SHA256

6f196c49ffd796235ba71147d57693abf690ed3524ee8afb24dab967b5fea287
SHA512

c54ddc4f6ca7b5a0796af83d644b1c820a96c4f960269ba69cc07c97dafacd0873701fee9003f534e9436a1a6a235c78524b73aafc69bda57c891cbca0ec281b
SSDEEP

6144:drPOJPFIAJxdnfmgCBHgmJUgiR9ps0SKbRml/9osEB9hYLkWYZ:VPOJa4vfSJU/RnPSKbRmLEBcLnYZ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

920 2960 WerFault.exe 1144-224-0x00000000008E0000-0x000000000094D000-memory.exe

pid	pid_target	process	target process
920	2960	WerFault.exe	1144-224-0x00000000008E0000-0x000000000094D000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1144-224-0x00000000008E0000-0x000000000094D000-memory.exe

description	pid	process	target process
PID 2960 wrote to memory of 920	2960	1144-224-0x00000000008E0000-0x000000000094D000-memory.exe	WerFault.exe
PID 2960 wrote to memory of 920	2960	1144-224-0x00000000008E0000-0x000000000094D000-memory.exe	WerFault.exe
PID 2960 wrote to memory of 920	2960	1144-224-0x00000000008E0000-0x000000000094D000-memory.exe	WerFault.exe
PID 2960 wrote to memory of 920	2960	1144-224-0x00000000008E0000-0x000000000094D000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1144-224-0x00000000008E0000-0x000000000094D000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1144-224-0x00000000008E0000-0x000000000094D000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 120
2⤵
- Program crash
PID:920