2a57fa0e264c30123d79d5a18397ff8ecfce4d9f58a5938c968ad3a9dd12e935

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 15:21

Target

209703dd4d6bb2be31fbd67713bc66dc1dd589baac7c01ca04d37e7c8d823793.exe
Size

989KB
MD5

79e53e4e66e3cc1c18c3eef54f3434c5
SHA1

4dacd0c65376af4ad6dd13d746ca048d4eba5b2b
SHA256

209703dd4d6bb2be31fbd67713bc66dc1dd589baac7c01ca04d37e7c8d823793
SHA512

009d33e03818679bfb172db7f498d394838c54ee1fcde9da94e20994f2d76c4e1aa30d64e9999fbeb96cd24f519f155cc03d624a903b1183c1d610c64d26c3c9
SSDEEP

12288:1jGKXgeOVTcldbKRr/4APMboMN6WvJaPuotB5xg8LumZjUjrTjpKt6Jiw3/:pGKXFOVTclERr/4APwoaBaJX1UPpKbc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1740	2032	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1740	2032	209703dd4d6bb2be31fbd67713bc66dc1dd589baac7c01ca04d37e7c8d823793.exe	28
PID 2032 wrote to memory of 1740	2032	209703dd4d6bb2be31fbd67713bc66dc1dd589baac7c01ca04d37e7c8d823793.exe	28
PID 2032 wrote to memory of 1740	2032	209703dd4d6bb2be31fbd67713bc66dc1dd589baac7c01ca04d37e7c8d823793.exe	28
PID 2032 wrote to memory of 1740	2032	209703dd4d6bb2be31fbd67713bc66dc1dd589baac7c01ca04d37e7c8d823793.exe	28

C:\Users\Admin\AppData\Local\Temp\209703dd4d6bb2be31fbd67713bc66dc1dd589baac7c01ca04d37e7c8d823793.exe
"C:\Users\Admin\AppData\Local\Temp\209703dd4d6bb2be31fbd67713bc66dc1dd589baac7c01ca04d37e7c8d823793.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 116
  2⤵
  - Program crash
  PID:1740

memory/2032-0-0x00000000010EA000-0x00000000010EB000-memory.dmp

Filesize
4KB

Download