def133b94e788a3a815b25047165f0bdb517edc4ddb035ddc65fc03edeb09f55

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-03-2024 08:30

Target

2112-299-0x0000000000400000-0x000000000046C000-memory.exe
Size

432KB
MD5

9089ede796eb6734c3be0cc24e4af5db
SHA1

4ee663ea77d9678e260ba6920b280f04feea5b28
SHA256

def133b94e788a3a815b25047165f0bdb517edc4ddb035ddc65fc03edeb09f55
SHA512

94eb5ad33c4d8fdeedd842ec73f0ebef73f75ccd54d5a9f3d0dcf1b51eb3bd988ef8ac2315b7b2def58c1c08a98180a7b55bff736fe76103f120bbb8e1312747
SSDEEP

6144:7uQRHexuieV+IiVN3f9MY8DWGUQOElBtObJV9DKhoCYLItjCNhuC:7uQRHexuieQ/EbYbxDKKtItjCK

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2188 1928 WerFault.exe 2112-299-0x0000000000400000-0x000000000046C000-memory.exe

pid	pid_target	process	target process
2188	1928	WerFault.exe	2112-299-0x0000000000400000-0x000000000046C000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2112-299-0x0000000000400000-0x000000000046C000-memory.exe

description	pid	process	target process
PID 1928 wrote to memory of 2188	1928	2112-299-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 1928 wrote to memory of 2188	1928	2112-299-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 1928 wrote to memory of 2188	1928	2112-299-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 1928 wrote to memory of 2188	1928	2112-299-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2112-299-0x0000000000400000-0x000000000046C000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2112-299-0x0000000000400000-0x000000000046C000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 36
2⤵
- Program crash
PID:2188