e26fabd2c7ff2793a03e50751c6b5c5606cd0dcc9f0fbec237db01080085c327

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 15:01

Target

809359f8fb559a3e0706be1ec11da34660665a2a47a87b69f26c35bc7ece21a0.exe
Size

332KB
MD5

dfdd7e6f5deadeae335e639e7bc7247c
SHA1

219556800d2be759004fc5a5776d5fa770f8c852
SHA256

809359f8fb559a3e0706be1ec11da34660665a2a47a87b69f26c35bc7ece21a0
SHA512

8d84856c7e7dc90ce96be856704b739980b159d3fa9fbd9fe328405aea712a4d4857407602d0a7f4c4d9d37ba610187dc9e1b8b2f8b989e2f80613a30ecbe406
SSDEEP

6144:63zwDH1EpC80M4ydBrEBniBBu0RSyghQbunDJAEaOp1z4+ox8fX5DM+0Xp:6jZpqM4ydBm/ygqSnNAEaOp1C8fJDh05

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1244 2364 WerFault.exe 809359f8fb559a3e0706be1ec11da34660665a2a47a87b69f26c35bc7ece21a0.exe

pid	pid_target	process	target process
1244	2364	WerFault.exe	809359f8fb559a3e0706be1ec11da34660665a2a47a87b69f26c35bc7ece21a0.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

809359f8fb559a3e0706be1ec11da34660665a2a47a87b69f26c35bc7ece21a0.exe

description	pid	process	target process
PID 2364 wrote to memory of 1244	2364	809359f8fb559a3e0706be1ec11da34660665a2a47a87b69f26c35bc7ece21a0.exe	WerFault.exe
PID 2364 wrote to memory of 1244	2364	809359f8fb559a3e0706be1ec11da34660665a2a47a87b69f26c35bc7ece21a0.exe	WerFault.exe
PID 2364 wrote to memory of 1244	2364	809359f8fb559a3e0706be1ec11da34660665a2a47a87b69f26c35bc7ece21a0.exe	WerFault.exe
PID 2364 wrote to memory of 1244	2364	809359f8fb559a3e0706be1ec11da34660665a2a47a87b69f26c35bc7ece21a0.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\809359f8fb559a3e0706be1ec11da34660665a2a47a87b69f26c35bc7ece21a0.exe
"C:\Users\Admin\AppData\Local\Temp\809359f8fb559a3e0706be1ec11da34660665a2a47a87b69f26c35bc7ece21a0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 52
2⤵
- Program crash
PID:1244

memory/2364-0-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2364-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download