6db80e6a112cee8e56cb2b9f4d6e042d21e1ad731aea24eddcbe4b046230fd33

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 03:55

Target

7682ec1cc9155e1dfa2ec2817f0510ac3f66800299088143f8a6b58eeb9a96c8.exe
Size

556KB
MD5

ab1d3e723949526483c90ca2e0f0f1f6
SHA1

6d02b0e48e9ed0e1f4f501e1986a6e3bb1b33ddd
SHA256

7682ec1cc9155e1dfa2ec2817f0510ac3f66800299088143f8a6b58eeb9a96c8
SHA512

7790cd1e86a5fed05847ffac0c7c300a519083c958958e7e4dcdb98f0cd14f155caace46c472df401bf26d7cbb45b1e2794989039626c41c37b6ab1c2a97b16c
SSDEEP

12288:j342O9hvImes/6HGf2c2aakHaRL3rVs1ONEKqJ5KdfLD01yRjiSYb3T9G3oNLCA:j342O9Jymf2c2at6RL3rgOrqcHZHiLCA

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2904 2872 WerFault.exe 7682ec1cc9155e1dfa2ec2817f0510ac3f66800299088143f8a6b58eeb9a96c8.exe

pid	pid_target	process	target process
2904	2872	WerFault.exe	7682ec1cc9155e1dfa2ec2817f0510ac3f66800299088143f8a6b58eeb9a96c8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7682ec1cc9155e1dfa2ec2817f0510ac3f66800299088143f8a6b58eeb9a96c8.exe

description	pid	process	target process
PID 2872 wrote to memory of 2904	2872	7682ec1cc9155e1dfa2ec2817f0510ac3f66800299088143f8a6b58eeb9a96c8.exe	WerFault.exe
PID 2872 wrote to memory of 2904	2872	7682ec1cc9155e1dfa2ec2817f0510ac3f66800299088143f8a6b58eeb9a96c8.exe	WerFault.exe
PID 2872 wrote to memory of 2904	2872	7682ec1cc9155e1dfa2ec2817f0510ac3f66800299088143f8a6b58eeb9a96c8.exe	WerFault.exe
PID 2872 wrote to memory of 2904	2872	7682ec1cc9155e1dfa2ec2817f0510ac3f66800299088143f8a6b58eeb9a96c8.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7682ec1cc9155e1dfa2ec2817f0510ac3f66800299088143f8a6b58eeb9a96c8.exe
"C:\Users\Admin\AppData\Local\Temp\7682ec1cc9155e1dfa2ec2817f0510ac3f66800299088143f8a6b58eeb9a96c8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 92
  2⤵
  - Program crash
  PID:2904

memory/2872-0-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download