19ef966a051fb80a7e9a4c226171784888184c9e12f75a8cc5d88da9ecab375f

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 15:11

Target

566c1670c8a5f43ec35b831518b15cf388fbddff2c3ba3ffc8167ac1bf0a1fb3.exe
Size

492KB
MD5

c40f810518e4290ab7fc1e07e5c83ff9
SHA1

9f8bc2e44eb00b71047c04864e007225eb9779c9
SHA256

566c1670c8a5f43ec35b831518b15cf388fbddff2c3ba3ffc8167ac1bf0a1fb3
SHA512

044be66f51e52b07e77105dcf1ab2b1c099636eaa557124e5e442b6c6383564d578c21f1a6a0a0a0caecb433a16a3f552b27aa5e714cccaf9bc01f2b741335fd
SSDEEP

12288:d4w4rJNNGCt//w5qVN2iu79mnxhyC4GNq/SBoCe:/4rfN5Xw5qVN2H79mrymyR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2840	2224	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2840	2224	566c1670c8a5f43ec35b831518b15cf388fbddff2c3ba3ffc8167ac1bf0a1fb3.exe	29
PID 2224 wrote to memory of 2840	2224	566c1670c8a5f43ec35b831518b15cf388fbddff2c3ba3ffc8167ac1bf0a1fb3.exe	29
PID 2224 wrote to memory of 2840	2224	566c1670c8a5f43ec35b831518b15cf388fbddff2c3ba3ffc8167ac1bf0a1fb3.exe	29
PID 2224 wrote to memory of 2840	2224	566c1670c8a5f43ec35b831518b15cf388fbddff2c3ba3ffc8167ac1bf0a1fb3.exe	29

C:\Users\Admin\AppData\Local\Temp\566c1670c8a5f43ec35b831518b15cf388fbddff2c3ba3ffc8167ac1bf0a1fb3.exe
"C:\Users\Admin\AppData\Local\Temp\566c1670c8a5f43ec35b831518b15cf388fbddff2c3ba3ffc8167ac1bf0a1fb3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 48
  2⤵
  - Program crash
  PID:2840

memory/2224-0-0x000000000125A000-0x000000000125C000-memory.dmp

Filesize
8KB

Download