0ff9bc0436d6052b24d3174a3e4aeb590fa03a5b78a09d0b6a5a4084006891e2

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 12:28

Target

75997a0972431bc5e7a704b53cd1a000bf6f1f51c31f2ef32b3af38f120ccfce.exe
Size

527KB
MD5

144e3fc197d288b006018a06681636eb
SHA1

82bc88c1799ade03d1dcecb8b13653c0aa90f475
SHA256

75997a0972431bc5e7a704b53cd1a000bf6f1f51c31f2ef32b3af38f120ccfce
SHA512

def371308bbde6c659c4b72a5d144bb9149931ec985ae2ccfe68cbb7acc6d15446cb917e4799908dfa4b65dae77a01980c5f52e6f80a3d39586039827d03cb40
SSDEEP

12288:vJYO+vkfgJbreygSCTUPAKRccEedsTm0eynOpWcDMvH0Xp:vJYmfgdRwedsTTPnfcDMvU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2216	1564	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 2216	1564	75997a0972431bc5e7a704b53cd1a000bf6f1f51c31f2ef32b3af38f120ccfce.exe	29
PID 1564 wrote to memory of 2216	1564	75997a0972431bc5e7a704b53cd1a000bf6f1f51c31f2ef32b3af38f120ccfce.exe	29
PID 1564 wrote to memory of 2216	1564	75997a0972431bc5e7a704b53cd1a000bf6f1f51c31f2ef32b3af38f120ccfce.exe	29
PID 1564 wrote to memory of 2216	1564	75997a0972431bc5e7a704b53cd1a000bf6f1f51c31f2ef32b3af38f120ccfce.exe	29

C:\Users\Admin\AppData\Local\Temp\75997a0972431bc5e7a704b53cd1a000bf6f1f51c31f2ef32b3af38f120ccfce.exe
"C:\Users\Admin\AppData\Local\Temp\75997a0972431bc5e7a704b53cd1a000bf6f1f51c31f2ef32b3af38f120ccfce.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 52
  2⤵
  - Program crash
  PID:2216

memory/1564-0-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/1564-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download