a6ab9224fdf93de39f8d7494ba4a1ecdda69e7f24930774316ce1e827e521076

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05-04-2024 01:28

Target

a6ab9224fdf93de39f8d7494ba4a1ecdda69e7f24930774316ce1e827e521076.exe
Size

2.7MB
MD5

0cda0c30f4ea0cd3ae66b971dfaa84ca
SHA1

a12177858d571e50967f5065b17117b14a8b3ef6
SHA256

a6ab9224fdf93de39f8d7494ba4a1ecdda69e7f24930774316ce1e827e521076
SHA512

a7a2201e6341023c25424295ff22e1ef5a9510fea9b1141930366eb814525ce8eba9e93b7c954b1aa0c633b67008977181e1dc90e3602ab2b946cb485cd3426c
SSDEEP

24576:d4sn9+gS6uHk1U441+hzy3cHoORwqetii6hsuiWLIkN0ISz/czSc:bLS6uH8U51HiohuwE2

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process

2840 2732 WerFault.exe

pid	pid_target	process
2840	2732	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a6ab9224fdf93de39f8d7494ba4a1ecdda69e7f24930774316ce1e827e521076.exe

description	pid	process	target process
PID 2732 wrote to memory of 2840	2732	a6ab9224fdf93de39f8d7494ba4a1ecdda69e7f24930774316ce1e827e521076.exe	WerFault.exe
PID 2732 wrote to memory of 2840	2732	a6ab9224fdf93de39f8d7494ba4a1ecdda69e7f24930774316ce1e827e521076.exe	WerFault.exe
PID 2732 wrote to memory of 2840	2732	a6ab9224fdf93de39f8d7494ba4a1ecdda69e7f24930774316ce1e827e521076.exe	WerFault.exe
PID 2732 wrote to memory of 2840	2732	a6ab9224fdf93de39f8d7494ba4a1ecdda69e7f24930774316ce1e827e521076.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a6ab9224fdf93de39f8d7494ba4a1ecdda69e7f24930774316ce1e827e521076.exe
"C:\Users\Admin\AppData\Local\Temp\a6ab9224fdf93de39f8d7494ba4a1ecdda69e7f24930774316ce1e827e521076.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 548
2⤵
- Program crash
PID:2840

memory/2732-1-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download
memory/2732-0-0x0000000000210000-0x00000000004C4000-memory.dmp

Filesize
2.7MB

Download
memory/2732-2-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download