7d410d6cb63e94a97e6688255ca56279bac5cacc70d37f91986f2235ce99ef8e

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 18:05 UTC

Target

2590c6aee0971ee73ddf13b31120ab5a7a7268c588bc55a8fe221b203913c447.exe
Size

314KB
MD5

a2e82df6d2a9597325d8523d3625b7c9
SHA1

1a5bf994f2bc9c0cd810e94776a3fc480f5d7f3b
SHA256

2590c6aee0971ee73ddf13b31120ab5a7a7268c588bc55a8fe221b203913c447
SHA512

1a89b7a438d12b21e4c2b2b9afbc348fcab3bfbce86b03ae49b001a5a184ed911cbf5f484da987c23957fec7afe9deebfc815215ef956bb3a8edf692a000eb10
SSDEEP

6144:znnpI60nbM8uPZy3+8KIDx7uVKBrC27XXJCWsgg5DeQhNM9PXHS:zn+60nbnuK7I+rC0XX4gg5CQhqHS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2512	2072	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2512	2072	2590c6aee0971ee73ddf13b31120ab5a7a7268c588bc55a8fe221b203913c447.exe	29
PID 2072 wrote to memory of 2512	2072	2590c6aee0971ee73ddf13b31120ab5a7a7268c588bc55a8fe221b203913c447.exe	29
PID 2072 wrote to memory of 2512	2072	2590c6aee0971ee73ddf13b31120ab5a7a7268c588bc55a8fe221b203913c447.exe	29
PID 2072 wrote to memory of 2512	2072	2590c6aee0971ee73ddf13b31120ab5a7a7268c588bc55a8fe221b203913c447.exe	29

C:\Users\Admin\AppData\Local\Temp\2590c6aee0971ee73ddf13b31120ab5a7a7268c588bc55a8fe221b203913c447.exe
"C:\Users\Admin\AppData\Local\Temp\2590c6aee0971ee73ddf13b31120ab5a7a7268c588bc55a8fe221b203913c447.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 36
  2⤵
  - Program crash
  PID:2512

memory/2072-0-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download