2974e6770a09814da49f9a9ff281cbd1ba5e6a3c4c1083101dc7621a52951cf4

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 19:53

Target

2974e6770a09814da49f9a9ff281cbd1ba5e6a3c4c1083101dc7621a52951cf4.exe
Size

292KB
MD5

d5bda0b0dadc85db286c157d6332fcf5
SHA1

0ccfce23994639c82c12b1e167889177d52e7f2b
SHA256

2974e6770a09814da49f9a9ff281cbd1ba5e6a3c4c1083101dc7621a52951cf4
SHA512

cdb6f32214b9824b464bae4d7c1cd0c7859eb2408d684710b11f86b658691b5ba1199ba1b6aa833eee0731fe4dfb35b8d32cf6c5b191d8549e869d70574b3b25
SSDEEP

3072:LkW/vdWkT/Ozb1/7xc1tdjZQQLnQhhyBZ8Irfdaqebssot7rfVtWzdbcGBXe:LP4K2bVYJuQ0hhynfdaJqNrzWzCqu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2240	1996	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2240	1996	2974e6770a09814da49f9a9ff281cbd1ba5e6a3c4c1083101dc7621a52951cf4.exe	28
PID 1996 wrote to memory of 2240	1996	2974e6770a09814da49f9a9ff281cbd1ba5e6a3c4c1083101dc7621a52951cf4.exe	28
PID 1996 wrote to memory of 2240	1996	2974e6770a09814da49f9a9ff281cbd1ba5e6a3c4c1083101dc7621a52951cf4.exe	28
PID 1996 wrote to memory of 2240	1996	2974e6770a09814da49f9a9ff281cbd1ba5e6a3c4c1083101dc7621a52951cf4.exe	28

C:\Users\Admin\AppData\Local\Temp\2974e6770a09814da49f9a9ff281cbd1ba5e6a3c4c1083101dc7621a52951cf4.exe
"C:\Users\Admin\AppData\Local\Temp\2974e6770a09814da49f9a9ff281cbd1ba5e6a3c4c1083101dc7621a52951cf4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 36
  2⤵
  - Program crash
  PID:2240

memory/1996-0-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download