2685b451d5bc5d1cd7c159a87efdfacd5a60c314491404e6e60e752ba3db90cf

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 15:27

Target

d4fbce6f6a714d781d28b578580461d8811477b0156700a58b25cdce361c4186.exe
Size

332KB
MD5

bc7667c9a8b990da87c094cedd6eb6b3
SHA1

e47843e711378f3cf738eba4341f44d410ca8e17
SHA256

d4fbce6f6a714d781d28b578580461d8811477b0156700a58b25cdce361c4186
SHA512

b7319862ce5b0f1b17506da2c19d90b5def5e0d9313f789755d4e492c83926b185793850ba7fc756ebdaf00fafa39eb51b27a4d62ab7472ebc546751eb16c1c6
SSDEEP

6144:WlZwB/LgLB340nTaDpOU7riHRkyghfOQE6q53Ppu9VA/4X2WFU23+0Xp:WnhLB340nTP+ygFLE/xuU/iU0Xp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1736	1960	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1736	1960	d4fbce6f6a714d781d28b578580461d8811477b0156700a58b25cdce361c4186.exe	29
PID 1960 wrote to memory of 1736	1960	d4fbce6f6a714d781d28b578580461d8811477b0156700a58b25cdce361c4186.exe	29
PID 1960 wrote to memory of 1736	1960	d4fbce6f6a714d781d28b578580461d8811477b0156700a58b25cdce361c4186.exe	29
PID 1960 wrote to memory of 1736	1960	d4fbce6f6a714d781d28b578580461d8811477b0156700a58b25cdce361c4186.exe	29

C:\Users\Admin\AppData\Local\Temp\d4fbce6f6a714d781d28b578580461d8811477b0156700a58b25cdce361c4186.exe
"C:\Users\Admin\AppData\Local\Temp\d4fbce6f6a714d781d28b578580461d8811477b0156700a58b25cdce361c4186.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 52
  2⤵
  - Program crash
  PID:1736

memory/1960-0-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/1960-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download