73fda21a667af6b6ffdf8f0219066c74de50318a40f83fe2cc6c35754a5c830a

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 13:16

Target

73fda21a667af6b6ffdf8f0219066c74de50318a40f83fe2cc6c35754a5c830a.exe
Size

899KB
MD5

dec8d9a4ef7d29dc2d97c6cfe4f12078
SHA1

e28bffc45f0f63a27841cf026728c8681acff28e
SHA256

73fda21a667af6b6ffdf8f0219066c74de50318a40f83fe2cc6c35754a5c830a
SHA512

abe5c1657a947a3686f9890d889c72ad4d42bf261a8033d098bc018efa5da43bbd0ab18b272645876683466026b38b9c8662433e117eb8d19e4cdd8dafa188a4
SSDEEP

24576:OGvrY3tcr1R2ydMQULhbeeE7xoD4UjJvC04nrD2GvrY3tcr1R2ydMQULhbeeE7xy:OLN+uC32LN+GE3q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2236	2248	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2236	2248	73fda21a667af6b6ffdf8f0219066c74de50318a40f83fe2cc6c35754a5c830a.exe	28
PID 2248 wrote to memory of 2236	2248	73fda21a667af6b6ffdf8f0219066c74de50318a40f83fe2cc6c35754a5c830a.exe	28
PID 2248 wrote to memory of 2236	2248	73fda21a667af6b6ffdf8f0219066c74de50318a40f83fe2cc6c35754a5c830a.exe	28
PID 2248 wrote to memory of 2236	2248	73fda21a667af6b6ffdf8f0219066c74de50318a40f83fe2cc6c35754a5c830a.exe	28

C:\Users\Admin\AppData\Local\Temp\73fda21a667af6b6ffdf8f0219066c74de50318a40f83fe2cc6c35754a5c830a.exe
"C:\Users\Admin\AppData\Local\Temp\73fda21a667af6b6ffdf8f0219066c74de50318a40f83fe2cc6c35754a5c830a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 152
  2⤵
  - Program crash
  PID:2236

memory/2248-0-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download