507a58a943968154426a46b3585d4e063da2c7858e2f3f5fb3f7e0c76e139ae3

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-03-2024 03:02

Target

1944-624-0x0000000000400000-0x000000000046C000-memory.exe
Size

432KB
MD5

0d58153254ddd81f3403a78845a8eae7
SHA1

c0dfc13a231f033826d154f0beefb9a63e4e177b
SHA256

507a58a943968154426a46b3585d4e063da2c7858e2f3f5fb3f7e0c76e139ae3
SHA512

39005074a8cc4a21f6b188d3aa68dfeb3429b1a7bdea942bbdc343fdb6a0db4735235c4f4ea5e41b25f08a6661bc8c5f4e9d1c26edbdfa1ba075af3e8f8b9fcf
SSDEEP

6144:7uQRHexuieV+IiVN3f9MY8DWGUQOElBtObJV9DKhoCY/ItjCNhul:7uQRHexuieQ/EbYbxDKKxItjCK

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2720 1332 WerFault.exe 1944-624-0x0000000000400000-0x000000000046C000-memory.exe

pid	pid_target	process	target process
2720	1332	WerFault.exe	1944-624-0x0000000000400000-0x000000000046C000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1944-624-0x0000000000400000-0x000000000046C000-memory.exe

description	pid	process	target process
PID 1332 wrote to memory of 2720	1332	1944-624-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 1332 wrote to memory of 2720	1332	1944-624-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 1332 wrote to memory of 2720	1332	1944-624-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 1332 wrote to memory of 2720	1332	1944-624-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1944-624-0x0000000000400000-0x000000000046C000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1944-624-0x0000000000400000-0x000000000046C000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 36
2⤵
- Program crash
PID:2720