e22a5cadeacc1a9d95354d85bdc17f6ab2dc5d23efe7df6d3d4683fb7b881a52

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 18:26

Target

6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe
Size

1.2MB
MD5

49653516356b84287648a3fbb3681ef3
SHA1

18d25bf8c3f6c8557d87966f8ea39c8f05f9f875
SHA256

6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8
SHA512

87d1127a9caa03f72f3c4b7f6215651e618cd2bad0c46100a5a5c921170d8fd5ba8dae53918efd18de3a8a305c95280b3558ac9d32081f33146e973104cdfc5a
SSDEEP

24576:UfBNveElInZKRPgiGiJvvTd1Y/ikf9PvXkfICSTxnO36c:UJ5InZKRPgiGi5YFBPGIjOh

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2200 1632 WerFault.exe 6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe

pid	pid_target	process	target process
2200	1632	WerFault.exe	6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe

description	pid	process	target process
PID 1632 wrote to memory of 2200	1632	6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe	WerFault.exe
PID 1632 wrote to memory of 2200	1632	6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe	WerFault.exe
PID 1632 wrote to memory of 2200	1632	6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe	WerFault.exe
PID 1632 wrote to memory of 2200	1632	6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe
"C:\Users\Admin\AppData\Local\Temp\6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 116
2⤵
- Program crash
PID:2200

memory/1632-0-0x0000000000DE6000-0x0000000000DE7000-memory.dmp

Filesize
4KB

Download