ed0a443b2be09275b5eb6892d6ca9403cc8c6498cdfbc65e1608690cb4de0338

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-03-2024 03:05

Target

5076-525-0x0000000000400000-0x000000000046C000-memory.exe
Size

432KB
MD5

1cabffa78cc787dde3ee03a79ddd246f
SHA1

b12a29455aa542bd0dc123378418e28182257eeb
SHA256

ed0a443b2be09275b5eb6892d6ca9403cc8c6498cdfbc65e1608690cb4de0338
SHA512

0e67fb370fb37f641def9cc02d8e017b8723705bf88a5d3b0a74f81d1bdacf8979b97d59ba3a857231573d5b7e7c5d6c169ea1fdf9f98996fa2440909dd211ce
SSDEEP

6144:7uQRHexuieV+IiVN3f9MY8DWGUQOElBtObJV9DKhoCYjItjCNhul:7uQRHexuieQ/EbYbxDKKpItjCK

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2168 2368 WerFault.exe 5076-525-0x0000000000400000-0x000000000046C000-memory.exe

pid	pid_target	process	target process
2168	2368	WerFault.exe	5076-525-0x0000000000400000-0x000000000046C000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5076-525-0x0000000000400000-0x000000000046C000-memory.exe

description	pid	process	target process
PID 2368 wrote to memory of 2168	2368	5076-525-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 2368 wrote to memory of 2168	2368	5076-525-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 2368 wrote to memory of 2168	2368	5076-525-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 2368 wrote to memory of 2168	2368	5076-525-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5076-525-0x0000000000400000-0x000000000046C000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\5076-525-0x0000000000400000-0x000000000046C000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 36
2⤵
- Program crash
PID:2168