9d4fd80315192f374f633129c212f0b6acb0377d5f4c9e18a437ec8c4063b448

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04-03-2024 00:15

Target

3508-274-0x0000000000400000-0x000000000046C000-memory.exe
Size

432KB
MD5

00e1d20a8d7420acf53a81e9cf882569
SHA1

0b2fc9ead5f791dacd1ab4b673c7e96bfc895121
SHA256

9d4fd80315192f374f633129c212f0b6acb0377d5f4c9e18a437ec8c4063b448
SHA512

583e8469fcad07611bfe7a22b962d124fdcf99a75e245ce9f4fc4189a3440601e5744ce7edfcac217d0eb9794aa4b2fa0fd4daccdb9836d64ad7905149dbf58b
SSDEEP

6144:7uQRHexuieV+IiVN3f9MY8DWGUQOElBtObJV9DKhoCYLItjCNhuC:7uQRHexuieQ/EbYbxDKKtItjCK

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3004 1148 WerFault.exe 3508-274-0x0000000000400000-0x000000000046C000-memory.exe

pid	pid_target	process	target process
3004	1148	WerFault.exe	3508-274-0x0000000000400000-0x000000000046C000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3508-274-0x0000000000400000-0x000000000046C000-memory.exe

description	pid	process	target process
PID 1148 wrote to memory of 3004	1148	3508-274-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 1148 wrote to memory of 3004	1148	3508-274-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 1148 wrote to memory of 3004	1148	3508-274-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 1148 wrote to memory of 3004	1148	3508-274-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3508-274-0x0000000000400000-0x000000000046C000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\3508-274-0x0000000000400000-0x000000000046C000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 36
2⤵
- Program crash
PID:3004