ebd9a15280a9fbd641ead11a6ab911fd72dcd48a6226e2e161005aebc9f70813

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 07:51

Target

35bc4e43814d2f85482e647760923539b90060bfc409f9e9258f5dfbf579bd95.exe
Size

368KB
MD5

623b8fa1a9ec0af23e0e48f1419f27c0
SHA1

e9f91a87dbee9567f44d038e7e6d59dac09e4ded
SHA256

35bc4e43814d2f85482e647760923539b90060bfc409f9e9258f5dfbf579bd95
SHA512

f06bc618165c0deeac9ed5cc137ed3b507383bfe79f71e58ee24022f930d19c862f974c4ec4e7fdf2665fb9962a12b13c1fbb8659957e0dacc2f87673dcada9f
SSDEEP

6144:SWNgTJjz5BLb5zFrOBC4FRqjEQnsgo5KbiZBNUg1ptNn5mk7lfHSKspi:SQgF511ztOBC4vF7sbU/UeptNnMsspi

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

476 2180 WerFault.exe 35bc4e43814d2f85482e647760923539b90060bfc409f9e9258f5dfbf579bd95.exe

pid	pid_target	process	target process
476	2180	WerFault.exe	35bc4e43814d2f85482e647760923539b90060bfc409f9e9258f5dfbf579bd95.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

35bc4e43814d2f85482e647760923539b90060bfc409f9e9258f5dfbf579bd95.exe

description	pid	process	target process
PID 2180 wrote to memory of 476	2180	35bc4e43814d2f85482e647760923539b90060bfc409f9e9258f5dfbf579bd95.exe	WerFault.exe
PID 2180 wrote to memory of 476	2180	35bc4e43814d2f85482e647760923539b90060bfc409f9e9258f5dfbf579bd95.exe	WerFault.exe
PID 2180 wrote to memory of 476	2180	35bc4e43814d2f85482e647760923539b90060bfc409f9e9258f5dfbf579bd95.exe	WerFault.exe
PID 2180 wrote to memory of 476	2180	35bc4e43814d2f85482e647760923539b90060bfc409f9e9258f5dfbf579bd95.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\35bc4e43814d2f85482e647760923539b90060bfc409f9e9258f5dfbf579bd95.exe
"C:\Users\Admin\AppData\Local\Temp\35bc4e43814d2f85482e647760923539b90060bfc409f9e9258f5dfbf579bd95.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 52
  2⤵
  - Program crash
  PID:476

memory/2180-0-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2180-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download