292b6242a8248f18030260bd0c373ec14be1362f7f7494bca33e42fcc97580b0

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 17:56

Target

d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe
Size

454KB
MD5

b7f76ced093ca9f03e791a1aeb35ed16
SHA1

ad59e7878fe7c94341ee5dad7b3950d168d5a97b
SHA256

d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765
SHA512

23fd42c33e514c2f21d4ea7fa40c7d3bd94da1fb7bad693e9e3d080310e793b82f35eea8912f7c1619e4705cf4976f892d87955e5e9c7a95d80bf6e8f888a1a2
SSDEEP

6144:ejo7W76rH+prJpH0AY3DYu+e3i27figCzqIU6vdpgRNmeBKZ4cyox1ZS/n4FPCKv:ez76rH+prJpUpYRlq2ejIZNDE/8PfeE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2636	1508	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 2636	1508	d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe	29
PID 1508 wrote to memory of 2636	1508	d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe	29
PID 1508 wrote to memory of 2636	1508	d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe	29
PID 1508 wrote to memory of 2636	1508	d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe	29

C:\Users\Admin\AppData\Local\Temp\d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe
"C:\Users\Admin\AppData\Local\Temp\d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 92
  2⤵
  - Program crash
  PID:2636

memory/1508-0-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download