7575b6a7ca1e6aeecfc397511f1b32b4a78d90e4766e4942510517290d09a617

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 18:07

Target

4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe
Size

306KB
MD5

d41a5cd7a3a7870992cfd75c5eff1637
SHA1

8365910e5f8fff802cd8d928351270432128abaa
SHA256

4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b
SHA512

893c73fe37c917bf3c8557c1344e03daef3d1264a0296847fbd5e667e0070b6c920a58f709ec96bb2c1afd22a485d366479f57911eb5073e4c77e6f43243604e
SSDEEP

6144:vBZd9vSWh60RVAtljy11yiI8iz2jaYO9eGoW/JyL985:JZiWhHE4i6qfRyL985

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1980 2168 WerFault.exe 4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe

pid	pid_target	process	target process
1980	2168	WerFault.exe	4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe

description	pid	process	target process
PID 2168 wrote to memory of 1980	2168	4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe	WerFault.exe
PID 2168 wrote to memory of 1980	2168	4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe	WerFault.exe
PID 2168 wrote to memory of 1980	2168	4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe	WerFault.exe
PID 2168 wrote to memory of 1980	2168	4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe
"C:\Users\Admin\AppData\Local\Temp\4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 88
2⤵
- Program crash
PID:1980

memory/2168-0-0x0000000000D08000-0x0000000000D09000-memory.dmp

Filesize
4KB

Download