a33c889b1929e9442a2a49de188e05a8ddbddcb32a7231b7c362f6833a45d720

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 14:40

Target

7f181e671ca7e88969b8dbb65e5906d2d04178a6bfb5756591ea3bc12c4809fc.exe
Size

332KB
MD5

b00adcc86618a8f28690451ebc279d6d
SHA1

c7bdbc58ba0151095793c5d57183060eaefed14f
SHA256

7f181e671ca7e88969b8dbb65e5906d2d04178a6bfb5756591ea3bc12c4809fc
SHA512

71a756e6328b3b226e8c52a8d3a831253b1221b1934cac2951d55c704c1c00153d9cc55bdf44380f21e82bf19d5a39bffc83154f33150c45a748cb4eaf6b56f6
SSDEEP

6144:klZwB/LgLN340nTaDpOU7riHRkyghGiypL8yFxCFXTAXDREodP+0Xp:knhLN340nTP+yg0iylxxCFUGodW0Xp

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2908 2752 WerFault.exe 7f181e671ca7e88969b8dbb65e5906d2d04178a6bfb5756591ea3bc12c4809fc.exe

pid	pid_target	process	target process
2908	2752	WerFault.exe	7f181e671ca7e88969b8dbb65e5906d2d04178a6bfb5756591ea3bc12c4809fc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7f181e671ca7e88969b8dbb65e5906d2d04178a6bfb5756591ea3bc12c4809fc.exe

description	pid	process	target process
PID 2752 wrote to memory of 2908	2752	7f181e671ca7e88969b8dbb65e5906d2d04178a6bfb5756591ea3bc12c4809fc.exe	WerFault.exe
PID 2752 wrote to memory of 2908	2752	7f181e671ca7e88969b8dbb65e5906d2d04178a6bfb5756591ea3bc12c4809fc.exe	WerFault.exe
PID 2752 wrote to memory of 2908	2752	7f181e671ca7e88969b8dbb65e5906d2d04178a6bfb5756591ea3bc12c4809fc.exe	WerFault.exe
PID 2752 wrote to memory of 2908	2752	7f181e671ca7e88969b8dbb65e5906d2d04178a6bfb5756591ea3bc12c4809fc.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7f181e671ca7e88969b8dbb65e5906d2d04178a6bfb5756591ea3bc12c4809fc.exe
"C:\Users\Admin\AppData\Local\Temp\7f181e671ca7e88969b8dbb65e5906d2d04178a6bfb5756591ea3bc12c4809fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 52
2⤵
- Program crash
PID:2908

memory/2752-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2752-0-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download