73157200729985f161a2bf9f6f7b55201f0cf21ac61721eca29d68d219301b22

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 12:44

Target

4156-4898-0x0000000000400000-0x0000000000648000-memory.exe
Size

2.3MB
MD5

87b2be0fb14e380f78cb21a87cf6ca0f
SHA1

8ff98c0ec3f59f4ded11adbea7a03aca897f006d
SHA256

73157200729985f161a2bf9f6f7b55201f0cf21ac61721eca29d68d219301b22
SHA512

fce2d3f8b00cf6b45ab9297e231563838816e198dfb7dc22ec5d6eaf1fb3c58258cecc085160a9c5bc7e12c30f8d72451539d2d0a4543cbd494a53b10d20795a
SSDEEP

3072:HDFbaT8zJWxoVOaLOE73cFnOzN3xzeLHR7uXGsocOHA8cs5qOllPKUU:5XJhVNaEgFn5l7uJW5Ll4UU

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2436 1876 WerFault.exe 4156-4898-0x0000000000400000-0x0000000000648000-memory.exe

pid	pid_target	process	target process
2436	1876	WerFault.exe	4156-4898-0x0000000000400000-0x0000000000648000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4156-4898-0x0000000000400000-0x0000000000648000-memory.exe

description	pid	process	target process
PID 1876 wrote to memory of 2436	1876	4156-4898-0x0000000000400000-0x0000000000648000-memory.exe	WerFault.exe
PID 1876 wrote to memory of 2436	1876	4156-4898-0x0000000000400000-0x0000000000648000-memory.exe	WerFault.exe
PID 1876 wrote to memory of 2436	1876	4156-4898-0x0000000000400000-0x0000000000648000-memory.exe	WerFault.exe
PID 1876 wrote to memory of 2436	1876	4156-4898-0x0000000000400000-0x0000000000648000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4156-4898-0x0000000000400000-0x0000000000648000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\4156-4898-0x0000000000400000-0x0000000000648000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 36
2⤵
- Program crash
PID:2436