f7dfaa9e79da582285f964c17f202631b50c186b56fbe2c417d1cb042b2ba655

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 12:54

Target

55b18033bb16a6ebd933d4b24c7828c19ea0ec0937cbb06be066053c204d9753.exe
Size

469KB
MD5

051f65734fe5b3908b4e8c8810866caa
SHA1

c94cfcbd18c595495d8851679c3a7eb6e6af1ec3
SHA256

55b18033bb16a6ebd933d4b24c7828c19ea0ec0937cbb06be066053c204d9753
SHA512

8a4770ca61f2a3f42631f61b55f256e362bb8c6766566ee6a1c18714d6e5f3f5590a1bf01f6d4ac0be80077c5a306acf6ed95338e0bb0731c35a352386f35b8a
SSDEEP

12288:ulBmU+zoOXc065zzMWv9yT2EyBkXoGzud3Kiz7xhGupT:M6zoOCzzMWVpEyedyd3/xhlT

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1524 1640 WerFault.exe 55b18033bb16a6ebd933d4b24c7828c19ea0ec0937cbb06be066053c204d9753.exe

pid	pid_target	process	target process
1524	1640	WerFault.exe	55b18033bb16a6ebd933d4b24c7828c19ea0ec0937cbb06be066053c204d9753.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

55b18033bb16a6ebd933d4b24c7828c19ea0ec0937cbb06be066053c204d9753.exe

description	pid	process	target process
PID 1640 wrote to memory of 1524	1640	55b18033bb16a6ebd933d4b24c7828c19ea0ec0937cbb06be066053c204d9753.exe	WerFault.exe
PID 1640 wrote to memory of 1524	1640	55b18033bb16a6ebd933d4b24c7828c19ea0ec0937cbb06be066053c204d9753.exe	WerFault.exe
PID 1640 wrote to memory of 1524	1640	55b18033bb16a6ebd933d4b24c7828c19ea0ec0937cbb06be066053c204d9753.exe	WerFault.exe
PID 1640 wrote to memory of 1524	1640	55b18033bb16a6ebd933d4b24c7828c19ea0ec0937cbb06be066053c204d9753.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\55b18033bb16a6ebd933d4b24c7828c19ea0ec0937cbb06be066053c204d9753.exe
"C:\Users\Admin\AppData\Local\Temp\55b18033bb16a6ebd933d4b24c7828c19ea0ec0937cbb06be066053c204d9753.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 120
2⤵
- Program crash
PID:1524

memory/1640-0-0x0000000000102000-0x0000000000103000-memory.dmp

Filesize
4KB

Download