ae29634c421e7fae872a93c040b896ad770641124691367109255096c87422ba

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 08:42

Target

ae84a961544dece93229953207f8c80747b6a606377bd6920b5aed289b1eab3c.exe
Size

297KB
MD5

6c3d589c8083af8f03b50d3e5cb3028b
SHA1

893c4bbb2be8ebba54c18345a0c2c8b512da69b9
SHA256

ae84a961544dece93229953207f8c80747b6a606377bd6920b5aed289b1eab3c
SHA512

aa11105f5a68a13ccc391ebbd11cd60965979ac40fd50b692a2aada85daf8444c31f69f6c434e91fd4e6dc608b9c27c2d1bbb908dfa1e367366890aa99dbbef1
SSDEEP

6144:tk87zE8yF+JnF/1VVsNxnXW0+scVpoAcyyTdgYK9djWvCoCe:287zE5iwNFWKKC4OdU9dnoCe

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2616	2192	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ae84a961544dece93229953207f8c80747b6a606377bd6920b5aed289b1eab3c.exe

description	pid	Process	procid_target
PID 2192 wrote to memory of 2616	2192	ae84a961544dece93229953207f8c80747b6a606377bd6920b5aed289b1eab3c.exe	29
PID 2192 wrote to memory of 2616	2192	ae84a961544dece93229953207f8c80747b6a606377bd6920b5aed289b1eab3c.exe	29
PID 2192 wrote to memory of 2616	2192	ae84a961544dece93229953207f8c80747b6a606377bd6920b5aed289b1eab3c.exe	29
PID 2192 wrote to memory of 2616	2192	ae84a961544dece93229953207f8c80747b6a606377bd6920b5aed289b1eab3c.exe	29

C:\Users\Admin\AppData\Local\Temp\ae84a961544dece93229953207f8c80747b6a606377bd6920b5aed289b1eab3c.exe
"C:\Users\Admin\AppData\Local\Temp\ae84a961544dece93229953207f8c80747b6a606377bd6920b5aed289b1eab3c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 48
  2⤵
  - Program crash
  PID:2616

memory/2192-0-0x000000000018A000-0x000000000018B000-memory.dmp

Filesize
4KB

Download