e22a5cadeacc1a9d95354d85bdc17f6ab2dc5d23efe7df6d3d4683fb7b881a52

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 18:26

Target

05a0748d48b19e76e2ac6f6c7a81179bc89e5adf95615c3d3417fc86f39342c0.exe
Size

296KB
MD5

1e1c1e0154da443ce8e83086f29a5838
SHA1

5be703f641f5a4bfbf54799747840cd570cd5046
SHA256

05a0748d48b19e76e2ac6f6c7a81179bc89e5adf95615c3d3417fc86f39342c0
SHA512

df9f5d25b6f7934c8994379cee15ec7b44abaef51823a3abe5499ce1cab047a5a17b4384b7fe1c9edbd09bd1279a71762da95881b3e789942d992acb99bc89e6
SSDEEP

6144:xq8jJ6IyLKHndgbV2NNXFZ4Cy12Cao91fNnWs70W5I2vCoCe:k8jJ6xENrZNy12Cn91FnWJoCe

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2840 1992 WerFault.exe 05a0748d48b19e76e2ac6f6c7a81179bc89e5adf95615c3d3417fc86f39342c0.exe

pid	pid_target	process	target process
2840	1992	WerFault.exe	05a0748d48b19e76e2ac6f6c7a81179bc89e5adf95615c3d3417fc86f39342c0.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

05a0748d48b19e76e2ac6f6c7a81179bc89e5adf95615c3d3417fc86f39342c0.exe

description	pid	process	target process
PID 1992 wrote to memory of 2840	1992	05a0748d48b19e76e2ac6f6c7a81179bc89e5adf95615c3d3417fc86f39342c0.exe	WerFault.exe
PID 1992 wrote to memory of 2840	1992	05a0748d48b19e76e2ac6f6c7a81179bc89e5adf95615c3d3417fc86f39342c0.exe	WerFault.exe
PID 1992 wrote to memory of 2840	1992	05a0748d48b19e76e2ac6f6c7a81179bc89e5adf95615c3d3417fc86f39342c0.exe	WerFault.exe
PID 1992 wrote to memory of 2840	1992	05a0748d48b19e76e2ac6f6c7a81179bc89e5adf95615c3d3417fc86f39342c0.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\05a0748d48b19e76e2ac6f6c7a81179bc89e5adf95615c3d3417fc86f39342c0.exe
"C:\Users\Admin\AppData\Local\Temp\05a0748d48b19e76e2ac6f6c7a81179bc89e5adf95615c3d3417fc86f39342c0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 48
2⤵
- Program crash
PID:2840

memory/1992-0-0x0000000000AF9000-0x0000000000AFB000-memory.dmp

Filesize
8KB

Download