f3dc166dc24cab46b924940574b34a40731bca659400af5be22e3b1ed6ab862a

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-04-2024 04:26

Target

f3dc166dc24cab46b924940574b34a40731bca659400af5be22e3b1ed6ab862a.exe
Size

4.7MB
MD5

9eba4477cfba9cebcf1c7ad372a21982
SHA1

dca917a8271a030ced7eed568c9f00cdb055a19a
SHA256

f3dc166dc24cab46b924940574b34a40731bca659400af5be22e3b1ed6ab862a
SHA512

5a958419b099df0668a38ab3961603130ffb8469ae4772971d834d7a623f823b6396386c0283e202953b1d25820dea1af6366be4344a883d625fb94f70d59eda
SSDEEP

49152:qiqr9Jx3iz9cfkhF7hFw8YWpJ7JBSpSTJyvwQKMtcXH5r2Bjut4+cLFF/csNW22h:9TafkhF7hFw8chWQCz22VR1C

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1636	2868	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 1636	2868	f3dc166dc24cab46b924940574b34a40731bca659400af5be22e3b1ed6ab862a.exe	28
PID 2868 wrote to memory of 1636	2868	f3dc166dc24cab46b924940574b34a40731bca659400af5be22e3b1ed6ab862a.exe	28
PID 2868 wrote to memory of 1636	2868	f3dc166dc24cab46b924940574b34a40731bca659400af5be22e3b1ed6ab862a.exe	28
PID 2868 wrote to memory of 1636	2868	f3dc166dc24cab46b924940574b34a40731bca659400af5be22e3b1ed6ab862a.exe	28

C:\Users\Admin\AppData\Local\Temp\f3dc166dc24cab46b924940574b34a40731bca659400af5be22e3b1ed6ab862a.exe
"C:\Users\Admin\AppData\Local\Temp\f3dc166dc24cab46b924940574b34a40731bca659400af5be22e3b1ed6ab862a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 548
  2⤵
  - Program crash
  PID:1636

memory/2868-1-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/2868-0-0x00000000010D0000-0x0000000001584000-memory.dmp

Filesize
4.7MB

Download
memory/2868-2-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download