36ed858788db1f702ab5de2d8563490f5f99ff179d74a78b63cb5d1a80f2281a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 16:06

Target

972-56-0x0000000000400000-0x0000000002BB0000-memory.exe
Size

39.7MB
MD5

c88813218a9ab8cb0ccfa317bee143ee
SHA1

8039b81334a634e118d752e2250ddb1ac71f199f
SHA256

36ed858788db1f702ab5de2d8563490f5f99ff179d74a78b63cb5d1a80f2281a
SHA512

035947eb3e9940b64198c2fd0bd3174e21629586105763e9d72830b6570878b1909f5d7733d8694fbd3b17627bfeef4f5f3ff181de3cb79fc12fe37dd2596896
SSDEEP

12288:16HX5aG782ook65G/id5CV5ovZVjpD9p:16HJdVook6E/8koVtD9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2928	2884	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2928	2884	972-56-0x0000000000400000-0x0000000002BB0000-memory.exe	28
PID 2884 wrote to memory of 2928	2884	972-56-0x0000000000400000-0x0000000002BB0000-memory.exe	28
PID 2884 wrote to memory of 2928	2884	972-56-0x0000000000400000-0x0000000002BB0000-memory.exe	28
PID 2884 wrote to memory of 2928	2884	972-56-0x0000000000400000-0x0000000002BB0000-memory.exe	28

C:\Users\Admin\AppData\Local\Temp\972-56-0x0000000000400000-0x0000000002BB0000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\972-56-0x0000000000400000-0x0000000002BB0000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 36
  2⤵
  - Program crash
  PID:2928