f7dfaa9e79da582285f964c17f202631b50c186b56fbe2c417d1cb042b2ba655

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 12:57

Target

55b18033bb16a6ebd933d4b24c7828c19ea0ec0937cbb06be066053c204d9753.exe
Size

469KB
MD5

051f65734fe5b3908b4e8c8810866caa
SHA1

c94cfcbd18c595495d8851679c3a7eb6e6af1ec3
SHA256

55b18033bb16a6ebd933d4b24c7828c19ea0ec0937cbb06be066053c204d9753
SHA512

8a4770ca61f2a3f42631f61b55f256e362bb8c6766566ee6a1c18714d6e5f3f5590a1bf01f6d4ac0be80077c5a306acf6ed95338e0bb0731c35a352386f35b8a
SSDEEP

12288:ulBmU+zoOXc065zzMWv9yT2EyBkXoGzud3Kiz7xhGupT:M6zoOCzzMWVpEyedyd3/xhlT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2052	1252	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 2052	1252	55b18033bb16a6ebd933d4b24c7828c19ea0ec0937cbb06be066053c204d9753.exe	28
PID 1252 wrote to memory of 2052	1252	55b18033bb16a6ebd933d4b24c7828c19ea0ec0937cbb06be066053c204d9753.exe	28
PID 1252 wrote to memory of 2052	1252	55b18033bb16a6ebd933d4b24c7828c19ea0ec0937cbb06be066053c204d9753.exe	28
PID 1252 wrote to memory of 2052	1252	55b18033bb16a6ebd933d4b24c7828c19ea0ec0937cbb06be066053c204d9753.exe	28

C:\Users\Admin\AppData\Local\Temp\55b18033bb16a6ebd933d4b24c7828c19ea0ec0937cbb06be066053c204d9753.exe
"C:\Users\Admin\AppData\Local\Temp\55b18033bb16a6ebd933d4b24c7828c19ea0ec0937cbb06be066053c204d9753.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 120
  2⤵
  - Program crash
  PID:2052

memory/1252-0-0x0000000000B32000-0x0000000000B33000-memory.dmp

Filesize
4KB

Download