3829081dc81e9a863b91bd92f1862374ab3313282494c5911d72530198649323

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05-04-2024 20:23

Target

3829081dc81e9a863b91bd92f1862374ab3313282494c5911d72530198649323.exe
Size

615KB
MD5

bc9717730a67ce53e665eb6fe1bdf1be
SHA1

904e1f71d5a07089e4b36c571fd17b3d85317bc9
SHA256

3829081dc81e9a863b91bd92f1862374ab3313282494c5911d72530198649323
SHA512

e5039201579777bccf67bafab1793b064783d069e9a47f47b021f8cdc1d5f536322f4c1289929671104c08ff98c25241f6964cc73f040dc79d2d2831a96d08b8
SSDEEP

3072:zJNRFJXC4ey1sL+rVsLq8Qr8ruG8qSrPrdrj+2O2U2wn2D09NC8SBg:LRFpcQy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3052	3012	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 3052	3012	3829081dc81e9a863b91bd92f1862374ab3313282494c5911d72530198649323.exe	28
PID 3012 wrote to memory of 3052	3012	3829081dc81e9a863b91bd92f1862374ab3313282494c5911d72530198649323.exe	28
PID 3012 wrote to memory of 3052	3012	3829081dc81e9a863b91bd92f1862374ab3313282494c5911d72530198649323.exe	28
PID 3012 wrote to memory of 3052	3012	3829081dc81e9a863b91bd92f1862374ab3313282494c5911d72530198649323.exe	28

C:\Users\Admin\AppData\Local\Temp\3829081dc81e9a863b91bd92f1862374ab3313282494c5911d72530198649323.exe
"C:\Users\Admin\AppData\Local\Temp\3829081dc81e9a863b91bd92f1862374ab3313282494c5911d72530198649323.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 548
  2⤵
  - Program crash
  PID:3052

memory/3012-0-0x0000000000B00000-0x0000000000BA0000-memory.dmp

Filesize
640KB

Download
memory/3012-1-0x00000000742A0000-0x000000007498E000-memory.dmp

Filesize
6.9MB

Download
memory/3012-2-0x00000000742A0000-0x000000007498E000-memory.dmp

Filesize
6.9MB

Download