9c547d620055a9eb5c983e61789b1c3f794c1ef7ddfcce934c32ac754a1d7988

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 06:43

Target

2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe
Size

402KB
MD5

f02798ba573318a4ba1bb6e39c45ad5c
SHA1

9b81fd616e27b9aeca4a5a42775df026da28f557
SHA256

2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826
SHA512

de15b3b67063359bad041e87e1f16029775ca16d2199b2284f3b3039c11f704f208fc994f1383aa7704a7c01544e87aba7c796c407c40c8281ebd607212f2385
SSDEEP

6144:dzOa82gO92tYhBOl+vCit0Y0d0ggOl3yinIvSC9dRuJSo+2Aymo/un7pespk:daaR9wYhYiCDQKIvZ1uJSo+jjoS8spk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2192	2928	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2192	2928	2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe	29
PID 2928 wrote to memory of 2192	2928	2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe	29
PID 2928 wrote to memory of 2192	2928	2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe	29
PID 2928 wrote to memory of 2192	2928	2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe	29

C:\Users\Admin\AppData\Local\Temp\2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe
"C:\Users\Admin\AppData\Local\Temp\2b9fa60df2621c7cd698d7d11007f8a04cb6586f495b58f4fd8cc5de5b04f826.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 52
  2⤵
  - Program crash
  PID:2192

memory/2928-0-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2928-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download