a33c889b1929e9442a2a49de188e05a8ddbddcb32a7231b7c362f6833a45d720

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 14:40

Target

2590c6aee0971ee73ddf13b31120ab5a7a7268c588bc55a8fe221b203913c447.exe
Size

314KB
MD5

a2e82df6d2a9597325d8523d3625b7c9
SHA1

1a5bf994f2bc9c0cd810e94776a3fc480f5d7f3b
SHA256

2590c6aee0971ee73ddf13b31120ab5a7a7268c588bc55a8fe221b203913c447
SHA512

1a89b7a438d12b21e4c2b2b9afbc348fcab3bfbce86b03ae49b001a5a184ed911cbf5f484da987c23957fec7afe9deebfc815215ef956bb3a8edf692a000eb10
SSDEEP

6144:znnpI60nbM8uPZy3+8KIDx7uVKBrC27XXJCWsgg5DeQhNM9PXHS:zn+60nbnuK7I+rC0XX4gg5CQhqHS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2988	1576	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 2988	1576	2590c6aee0971ee73ddf13b31120ab5a7a7268c588bc55a8fe221b203913c447.exe	29
PID 1576 wrote to memory of 2988	1576	2590c6aee0971ee73ddf13b31120ab5a7a7268c588bc55a8fe221b203913c447.exe	29
PID 1576 wrote to memory of 2988	1576	2590c6aee0971ee73ddf13b31120ab5a7a7268c588bc55a8fe221b203913c447.exe	29
PID 1576 wrote to memory of 2988	1576	2590c6aee0971ee73ddf13b31120ab5a7a7268c588bc55a8fe221b203913c447.exe	29

C:\Users\Admin\AppData\Local\Temp\2590c6aee0971ee73ddf13b31120ab5a7a7268c588bc55a8fe221b203913c447.exe
"C:\Users\Admin\AppData\Local\Temp\2590c6aee0971ee73ddf13b31120ab5a7a7268c588bc55a8fe221b203913c447.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 36
  2⤵
  - Program crash
  PID:2988

memory/1576-0-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download