9612041510134f1c92563e23f0d584b9a266e673a4e06a9014fb2d4bf490e72c

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 01:12

Target

9612041510134f1c92563e23f0d584b9a266e673a4e06a9014fb2d4bf490e72c.exe
Size

1.7MB
MD5

17b8c832daeddee6b55224635d59ffc0
SHA1

a9953db8e7e7181ff9fb9a627de18015bd04214f
SHA256

9612041510134f1c92563e23f0d584b9a266e673a4e06a9014fb2d4bf490e72c
SHA512

66b8c994d84c815597c0ab5372440bfaac2bbe0e534620252933d7f8d5d94cffa86c6c39375340dc0626500225a8198e1038806ae4aa91795abf8f751cd6a70d
SSDEEP

12288:1EbgBJg4psks9ncJwYkw0LOLHjHd3KfWwNU17o126+X6R24zuFI4VDfVul9I1EaD:nPsn9+gS6uHk1U4zAIkNKI1EaHOj11m

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2836 2064 WerFault.exe 9612041510134f1c92563e23f0d584b9a266e673a4e06a9014fb2d4bf490e72c.exe

pid	pid_target	process	target process
2836	2064	WerFault.exe	9612041510134f1c92563e23f0d584b9a266e673a4e06a9014fb2d4bf490e72c.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9612041510134f1c92563e23f0d584b9a266e673a4e06a9014fb2d4bf490e72c.exe

description	pid	process	target process
PID 2064 wrote to memory of 2836	2064	9612041510134f1c92563e23f0d584b9a266e673a4e06a9014fb2d4bf490e72c.exe	WerFault.exe
PID 2064 wrote to memory of 2836	2064	9612041510134f1c92563e23f0d584b9a266e673a4e06a9014fb2d4bf490e72c.exe	WerFault.exe
PID 2064 wrote to memory of 2836	2064	9612041510134f1c92563e23f0d584b9a266e673a4e06a9014fb2d4bf490e72c.exe	WerFault.exe
PID 2064 wrote to memory of 2836	2064	9612041510134f1c92563e23f0d584b9a266e673a4e06a9014fb2d4bf490e72c.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9612041510134f1c92563e23f0d584b9a266e673a4e06a9014fb2d4bf490e72c.exe
"C:\Users\Admin\AppData\Local\Temp\9612041510134f1c92563e23f0d584b9a266e673a4e06a9014fb2d4bf490e72c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 548
2⤵
- Program crash
PID:2836

memory/2064-0-0x0000000000EB0000-0x0000000001072000-memory.dmp

Filesize
1.8MB

Download
memory/2064-1-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download
memory/2064-2-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download