3d51ba2854dc112717cd09675fef9cbf6256314f08695802efb6dfb20b3debe9

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-04-2024 01:05

Target

3d51ba2854dc112717cd09675fef9cbf6256314f08695802efb6dfb20b3debe9.exe
Size

2.7MB
MD5

9cc5ea0537e8d7ad5084bf693aba1343
SHA1

26bcc6bf4bb410c4f4a258e5da50f0a7ca851cfa
SHA256

3d51ba2854dc112717cd09675fef9cbf6256314f08695802efb6dfb20b3debe9
SHA512

8921826708a02909dae508ca6bc9723f4b455ab08a92af1ecbc38bb78456b741322bac5542a55935b912b8aad0a319d5c6d011fbcccf7f32ddcccacc01979005
SSDEEP

24576:yCsn9+gS6uHk1U4cv+hzy3cHoORwqetii6hsuiWlIkNeILz/cYSc:2LS6uH8UhvHiohoLE5

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2948 1812 WerFault.exe 3d51ba2854dc112717cd09675fef9cbf6256314f08695802efb6dfb20b3debe9.exe

pid	pid_target	process	target process
2948	1812	WerFault.exe	3d51ba2854dc112717cd09675fef9cbf6256314f08695802efb6dfb20b3debe9.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3d51ba2854dc112717cd09675fef9cbf6256314f08695802efb6dfb20b3debe9.exe

description	pid	process	target process
PID 1812 wrote to memory of 2948	1812	3d51ba2854dc112717cd09675fef9cbf6256314f08695802efb6dfb20b3debe9.exe	WerFault.exe
PID 1812 wrote to memory of 2948	1812	3d51ba2854dc112717cd09675fef9cbf6256314f08695802efb6dfb20b3debe9.exe	WerFault.exe
PID 1812 wrote to memory of 2948	1812	3d51ba2854dc112717cd09675fef9cbf6256314f08695802efb6dfb20b3debe9.exe	WerFault.exe
PID 1812 wrote to memory of 2948	1812	3d51ba2854dc112717cd09675fef9cbf6256314f08695802efb6dfb20b3debe9.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3d51ba2854dc112717cd09675fef9cbf6256314f08695802efb6dfb20b3debe9.exe
"C:\Users\Admin\AppData\Local\Temp\3d51ba2854dc112717cd09675fef9cbf6256314f08695802efb6dfb20b3debe9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 552
2⤵
- Program crash
PID:2948

memory/1812-1-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/1812-0-0x0000000001320000-0x00000000015D4000-memory.dmp

Filesize
2.7MB

Download
memory/1812-2-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download