668bf0046c8b19703e53408312fc0c9cea5fbe26731b2c5728e27c9309a37ad6

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-03-2024 01:23

Target

668bf0046c8b19703e53408312fc0c9cea5fbe26731b2c5728e27c9309a37ad6.exe
Size

2.7MB
MD5

266a3eb7b9d87e78990ed5490cd0e9f1
SHA1

8ea59bb84e9e844e258531ab38f09785df62f6cc
SHA256

668bf0046c8b19703e53408312fc0c9cea5fbe26731b2c5728e27c9309a37ad6
SHA512

368d791b087b6bf971c2f13fd7b622ba6b44442ff7881037e3f0ed237f9af4fdcfafd3a078bda8d7d1ec2eac126093ce8ca921671aa7389ad1d91fe0958fa9a1
SSDEEP

24576:94sn9+gS6uHk1U4k/+hzy3cHoORwqetii6hsuiWhIkNSIIx2X6Sc:HLS6uH8UR/HiohoIx2r

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1092 2180 WerFault.exe 668bf0046c8b19703e53408312fc0c9cea5fbe26731b2c5728e27c9309a37ad6.exe

pid	pid_target	process	target process
1092	2180	WerFault.exe	668bf0046c8b19703e53408312fc0c9cea5fbe26731b2c5728e27c9309a37ad6.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

668bf0046c8b19703e53408312fc0c9cea5fbe26731b2c5728e27c9309a37ad6.exe

description	pid	process	target process
PID 2180 wrote to memory of 1092	2180	668bf0046c8b19703e53408312fc0c9cea5fbe26731b2c5728e27c9309a37ad6.exe	WerFault.exe
PID 2180 wrote to memory of 1092	2180	668bf0046c8b19703e53408312fc0c9cea5fbe26731b2c5728e27c9309a37ad6.exe	WerFault.exe
PID 2180 wrote to memory of 1092	2180	668bf0046c8b19703e53408312fc0c9cea5fbe26731b2c5728e27c9309a37ad6.exe	WerFault.exe
PID 2180 wrote to memory of 1092	2180	668bf0046c8b19703e53408312fc0c9cea5fbe26731b2c5728e27c9309a37ad6.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\668bf0046c8b19703e53408312fc0c9cea5fbe26731b2c5728e27c9309a37ad6.exe
"C:\Users\Admin\AppData\Local\Temp\668bf0046c8b19703e53408312fc0c9cea5fbe26731b2c5728e27c9309a37ad6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 552
2⤵
- Program crash
PID:1092

memory/2180-1-0x0000000074010000-0x00000000746FE000-memory.dmp

Filesize
6.9MB

Download
memory/2180-0-0x0000000000E80000-0x0000000001134000-memory.dmp

Filesize
2.7MB

Download
memory/2180-2-0x0000000074010000-0x00000000746FE000-memory.dmp

Filesize
6.9MB

Download