9bf42d30009d4ddad615b803ba623f0520c82c23439142288ce711002d7b3292

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 14:50

Target

8a870280a0dc165cadf46427c4e47c56d3fa42aa2cf823a54358bf48f5102435.exe
Size

332KB
MD5

f98aa564c242bfb196410e0790d86bec
SHA1

c882a94a6303f80aca544fad54502ae09289d107
SHA256

8a870280a0dc165cadf46427c4e47c56d3fa42aa2cf823a54358bf48f5102435
SHA512

695ccefb3486c9a1e04eafa38f9a58b66360b0529dcaec4b73925985220be1f244b19ce59a22cd0f179245380d87bd2e3bb3f5aa394b61fede1a80f756dc2fbd
SSDEEP

6144:03TwjHHEJ9B4S9re5BAYhePRmygh6BSJ/Yt7wuo1+Wjnhx+0Xp:0DrJ9B4S9rPiygcBO/q++6U0Xp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1744	1720	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1744	1720	8a870280a0dc165cadf46427c4e47c56d3fa42aa2cf823a54358bf48f5102435.exe	29
PID 1720 wrote to memory of 1744	1720	8a870280a0dc165cadf46427c4e47c56d3fa42aa2cf823a54358bf48f5102435.exe	29
PID 1720 wrote to memory of 1744	1720	8a870280a0dc165cadf46427c4e47c56d3fa42aa2cf823a54358bf48f5102435.exe	29
PID 1720 wrote to memory of 1744	1720	8a870280a0dc165cadf46427c4e47c56d3fa42aa2cf823a54358bf48f5102435.exe	29

C:\Users\Admin\AppData\Local\Temp\8a870280a0dc165cadf46427c4e47c56d3fa42aa2cf823a54358bf48f5102435.exe
"C:\Users\Admin\AppData\Local\Temp\8a870280a0dc165cadf46427c4e47c56d3fa42aa2cf823a54358bf48f5102435.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 52
  2⤵
  - Program crash
  PID:1744

memory/1720-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/1720-0-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download