0d3870d43882a263c0511d1f89fbae94912261a6be64dc949d87cdad8f3a7de8

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 18:18

Target

51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe
Size

315KB
MD5

290b0115d137ba7f6f75557dea9a3418
SHA1

4fd841d032858a7bc39d598eca329371bc48a118
SHA256

51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7
SHA512

b843b5beea655f803deb8473cb9ed4f06e0d99c46480dcce39d321b1bcb4b4dff4350bd7c41f6ca0f3eaae31e73e9351ec5de920eddfedc809f119effe362a34
SSDEEP

6144:8A9pI60nbM8uPZy3+8KIDJgu+PchgHadTi7ZiEfXHS:H9+60nbnueg3cy6RFEPHS

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2212 1252 WerFault.exe 51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe

pid	pid_target	process	target process
2212	1252	WerFault.exe	51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe

description	pid	process	target process
PID 1252 wrote to memory of 2212	1252	51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe	WerFault.exe
PID 1252 wrote to memory of 2212	1252	51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe	WerFault.exe
PID 1252 wrote to memory of 2212	1252	51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe	WerFault.exe
PID 1252 wrote to memory of 2212	1252	51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe
"C:\Users\Admin\AppData\Local\Temp\51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 36
  2⤵
  - Program crash
  PID:2212

memory/1252-0-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download