b6c05f682229d3265e6cc66a1d148cb36d6950b9d97b71883006400922162147

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-03-2024 00:33

Target

4200-298-0x0000000000400000-0x000000000046C000-memory.exe
Size

432KB
MD5

e07b9f49b17f6c0895daca35b462b8cf
SHA1

cf4784b7f157e5a3897989e6155d3314134ffa12
SHA256

b6c05f682229d3265e6cc66a1d148cb36d6950b9d97b71883006400922162147
SHA512

c1364d75ffbf1835aca035d6c1c684cc74673154cd2ff2ac6a5c5049788217b0b514b0f3005ae785985d7fb4bc19365cf5b3d0b3accfe41cddbf8f65a3bbafc7
SSDEEP

6144:7uQRHexuieV+IiVN3f9MY8DWGUQOElBtObJV9DKhoCYLItjCNhuC:7uQRHexuieQ/EbYbxDKKtItjCK

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1696 1652 WerFault.exe 4200-298-0x0000000000400000-0x000000000046C000-memory.exe

pid	pid_target	process	target process
1696	1652	WerFault.exe	4200-298-0x0000000000400000-0x000000000046C000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4200-298-0x0000000000400000-0x000000000046C000-memory.exe

description	pid	process	target process
PID 1652 wrote to memory of 1696	1652	4200-298-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 1652 wrote to memory of 1696	1652	4200-298-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 1652 wrote to memory of 1696	1652	4200-298-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 1652 wrote to memory of 1696	1652	4200-298-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4200-298-0x0000000000400000-0x000000000046C000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\4200-298-0x0000000000400000-0x000000000046C000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 36
2⤵
- Program crash
PID:1696