a16a01ffdfddd1fd8f3e5c37b27921739aa27c5b81afad62bec9bb0b93e2e59b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04-03-2024 05:19

Target

3596-299-0x0000000000400000-0x000000000046C000-memory.exe
Size

432KB
MD5

c1b9b23427168dc6641fb639bca48e79
SHA1

d839239c574f0c0bd50ca31d96501485bda1b865
SHA256

a16a01ffdfddd1fd8f3e5c37b27921739aa27c5b81afad62bec9bb0b93e2e59b
SHA512

84c170d6aac178e0001b2772300e1f6116686830bc136f3971041570421201c7beff3f53c17d7b54993747bd0f4cf847ad8ca791d947836907476077cf5525d9
SSDEEP

6144:7uQRHexuieV+IiVN3f9MY8DWGUQOElBtObJV9DKhoCYAItjCNhul:7uQRHexuieQ/EbYbxDKKCItjCK

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1876 2388 WerFault.exe 3596-299-0x0000000000400000-0x000000000046C000-memory.exe

pid	pid_target	process	target process
1876	2388	WerFault.exe	3596-299-0x0000000000400000-0x000000000046C000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3596-299-0x0000000000400000-0x000000000046C000-memory.exe

description	pid	process	target process
PID 2388 wrote to memory of 1876	2388	3596-299-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 2388 wrote to memory of 1876	2388	3596-299-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 2388 wrote to memory of 1876	2388	3596-299-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 2388 wrote to memory of 1876	2388	3596-299-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3596-299-0x0000000000400000-0x000000000046C000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\3596-299-0x0000000000400000-0x000000000046C000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 36
2⤵
- Program crash
PID:1876