ebd9a15280a9fbd641ead11a6ab911fd72dcd48a6226e2e161005aebc9f70813

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 07:51

Target

4cb31f294446f49a65cd3fd2c837cbd7bb85178d6c87015ac8bb7835de3a193a.exe
Size

521KB
MD5

5bf09899bc5cc12a03b75d86a5bba534
SHA1

41585ae9bba21ac9d348ccd25c57b7aa448f8460
SHA256

4cb31f294446f49a65cd3fd2c837cbd7bb85178d6c87015ac8bb7835de3a193a
SHA512

da4dba8c05117ff93776a91564197fc019d1b21bcb388d1f0990164009411bfce8d86e8cd9ac6ea8513b50e650f800f4e0c545cf766ffa423846475d57375b40
SSDEEP

12288:Xi0C+NSUvQ92mN6ygGjZXeY4m/QScIFyFctYj0Xp:XxCcvQV/4MQSchMF

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1752 2376 WerFault.exe 4cb31f294446f49a65cd3fd2c837cbd7bb85178d6c87015ac8bb7835de3a193a.exe

pid	pid_target	process	target process
1752	2376	WerFault.exe	4cb31f294446f49a65cd3fd2c837cbd7bb85178d6c87015ac8bb7835de3a193a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4cb31f294446f49a65cd3fd2c837cbd7bb85178d6c87015ac8bb7835de3a193a.exe

description	pid	process	target process
PID 2376 wrote to memory of 1752	2376	4cb31f294446f49a65cd3fd2c837cbd7bb85178d6c87015ac8bb7835de3a193a.exe	WerFault.exe
PID 2376 wrote to memory of 1752	2376	4cb31f294446f49a65cd3fd2c837cbd7bb85178d6c87015ac8bb7835de3a193a.exe	WerFault.exe
PID 2376 wrote to memory of 1752	2376	4cb31f294446f49a65cd3fd2c837cbd7bb85178d6c87015ac8bb7835de3a193a.exe	WerFault.exe
PID 2376 wrote to memory of 1752	2376	4cb31f294446f49a65cd3fd2c837cbd7bb85178d6c87015ac8bb7835de3a193a.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4cb31f294446f49a65cd3fd2c837cbd7bb85178d6c87015ac8bb7835de3a193a.exe
"C:\Users\Admin\AppData\Local\Temp\4cb31f294446f49a65cd3fd2c837cbd7bb85178d6c87015ac8bb7835de3a193a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 52
2⤵
- Program crash
PID:1752

memory/2376-0-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2376-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download