19ef966a051fb80a7e9a4c226171784888184c9e12f75a8cc5d88da9ecab375f

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 15:11

Target

236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe
Size

694KB
MD5

c8032b42738527a70de1dadc4a7bff5b
SHA1

f5f778df15d4e14503bea0f654cf9427ba050a38
SHA256

236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5
SHA512

babddfaac51c11952a79047852b01c499075acfe24e91dac46a5c590a31be1e4e71df5b1daf27254d9d608fa7345839790f8a550e04392de7f625c5d6b22a97d
SSDEEP

12288:OO0Jg3ZJ7hWFArUqHsjumNFcF9gopM3bcgsqV5P3JkTC:OJJU7hWFuHyumzcCLUqV5v0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2344	2884	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2344	2884	236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe	29
PID 2884 wrote to memory of 2344	2884	236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe	29
PID 2884 wrote to memory of 2344	2884	236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe	29
PID 2884 wrote to memory of 2344	2884	236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe	29

C:\Users\Admin\AppData\Local\Temp\236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe
"C:\Users\Admin\AppData\Local\Temp\236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 128
  2⤵
  - Program crash
  PID:2344

memory/2884-0-0x0000000000120000-0x000000000016D000-memory.dmp

Filesize
308KB

Download
memory/2884-5-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download