5029311ee6003a5350130f76ae2218f7366adc28d09c08d6464f58e7f6398fe6

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 03:59

Target

5029311ee6003a5350130f76ae2218f7366adc28d09c08d6464f58e7f6398fe6.exe
Size

6.1MB
MD5

aadcb48e55bc9b46330af12e1f07149e
SHA1

899603c0be689463161d54ca169e8469f47c4458
SHA256

5029311ee6003a5350130f76ae2218f7366adc28d09c08d6464f58e7f6398fe6
SHA512

db1fe544f1fdd3653500301a632534bee7d45f6faa85dfe35a4d64b9ae75637d510653571661d92bf295d3e43334dc18cbfda076076715771bbcee8336368fb6
SSDEEP

49152:ANviFe5H7gbXKP19kKNGlXhV6DwOGRJBD9KGiJZIln/fIA2Mg+0SBI3XNvqVUq4/:ANviR6UPLnn/WBymPQFeQzkjwQF7

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2548 3024 WerFault.exe 5029311ee6003a5350130f76ae2218f7366adc28d09c08d6464f58e7f6398fe6.exe

pid	pid_target	process	target process
2548	3024	WerFault.exe	5029311ee6003a5350130f76ae2218f7366adc28d09c08d6464f58e7f6398fe6.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5029311ee6003a5350130f76ae2218f7366adc28d09c08d6464f58e7f6398fe6.exe

description	pid	process	target process
PID 3024 wrote to memory of 2548	3024	5029311ee6003a5350130f76ae2218f7366adc28d09c08d6464f58e7f6398fe6.exe	WerFault.exe
PID 3024 wrote to memory of 2548	3024	5029311ee6003a5350130f76ae2218f7366adc28d09c08d6464f58e7f6398fe6.exe	WerFault.exe
PID 3024 wrote to memory of 2548	3024	5029311ee6003a5350130f76ae2218f7366adc28d09c08d6464f58e7f6398fe6.exe	WerFault.exe
PID 3024 wrote to memory of 2548	3024	5029311ee6003a5350130f76ae2218f7366adc28d09c08d6464f58e7f6398fe6.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5029311ee6003a5350130f76ae2218f7366adc28d09c08d6464f58e7f6398fe6.exe
"C:\Users\Admin\AppData\Local\Temp\5029311ee6003a5350130f76ae2218f7366adc28d09c08d6464f58e7f6398fe6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 560
  2⤵
  - Program crash
  PID:2548

memory/3024-0-0x0000000000C20000-0x0000000001232000-memory.dmp

Filesize
6.1MB

Download
memory/3024-1-0x0000000074940000-0x000000007502E000-memory.dmp

Filesize
6.9MB

Download
memory/3024-2-0x0000000000820000-0x0000000000860000-memory.dmp

Filesize
256KB

Download
memory/3024-3-0x0000000074940000-0x000000007502E000-memory.dmp

Filesize
6.9MB

Download
memory/3024-4-0x0000000000820000-0x0000000000860000-memory.dmp

Filesize
256KB

Download