9c547d620055a9eb5c983e61789b1c3f794c1ef7ddfcce934c32ac754a1d7988

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 06:37

Target
2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe
Size 402KB
Sample240511-hdvdmaba2x
SHA256 2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826
MD5 f02798ba573318a4ba1bb6e39c45ad5c
SHA1 9b81fd616e27b9aeca4a5a42775df026da28f557
SHA512 de15b3b67063359bad041e87e1f16029775ca16d2199b2284f3b3039c11f704f208fc994f1383aa7704a7c01544e87aba7c796c407c40c8281ebd607212f2385
SSDEEP 6144:dzOa82gO92tYhBOl+vCit0Y0d0ggOl3yinIvSC9dRuJSo+2Aymo/un7pespk:daaR9wYhYiCDQKIvZ1uJSo+jjoS8spk
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1396	1740	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1396	1740	2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe	29
PID 1740 wrote to memory of 1396	1740	2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe	29
PID 1740 wrote to memory of 1396	1740	2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe	29
PID 1740 wrote to memory of 1396	1740	2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe	29

C:\Users\Admin\AppData\Local\Temp\2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe
"C:\Users\Admin\AppData\Local\Temp\2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 52
  2⤵
  - Program crash
  PID:1396

memory/1740-0-0x0000000000030000-0x0000000000031000-memory.dmp

Download

memory/1740-1-0x0000000000030000-0x0000000000031000-memory.dmp

Download