9bf42d30009d4ddad615b803ba623f0520c82c23439142288ce711002d7b3292

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 14:50

Target

4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe
Size

306KB
MD5

d41a5cd7a3a7870992cfd75c5eff1637
SHA1

8365910e5f8fff802cd8d928351270432128abaa
SHA256

4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b
SHA512

893c73fe37c917bf3c8557c1344e03daef3d1264a0296847fbd5e667e0070b6c920a58f709ec96bb2c1afd22a485d366479f57911eb5073e4c77e6f43243604e
SSDEEP

6144:vBZd9vSWh60RVAtljy11yiI8iz2jaYO9eGoW/JyL985:JZiWhHE4i6qfRyL985

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1020 1660 WerFault.exe 4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe

pid	pid_target	process	target process
1020	1660	WerFault.exe	4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe

description	pid	process	target process
PID 1660 wrote to memory of 1020	1660	4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe	WerFault.exe
PID 1660 wrote to memory of 1020	1660	4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe	WerFault.exe
PID 1660 wrote to memory of 1020	1660	4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe	WerFault.exe
PID 1660 wrote to memory of 1020	1660	4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe
"C:\Users\Admin\AppData\Local\Temp\4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 88
  2⤵
  - Program crash
  PID:1020

memory/1660-0-0x0000000001128000-0x0000000001129000-memory.dmp

Filesize
4KB

Download