ae29634c421e7fae872a93c040b896ad770641124691367109255096c87422ba

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 08:42

Target

51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe
Size

315KB
MD5

290b0115d137ba7f6f75557dea9a3418
SHA1

4fd841d032858a7bc39d598eca329371bc48a118
SHA256

51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7
SHA512

b843b5beea655f803deb8473cb9ed4f06e0d99c46480dcce39d321b1bcb4b4dff4350bd7c41f6ca0f3eaae31e73e9351ec5de920eddfedc809f119effe362a34
SSDEEP

6144:8A9pI60nbM8uPZy3+8KIDJgu+PchgHadTi7ZiEfXHS:H9+60nbnueg3cy6RFEPHS

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2876	2396	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe

description	pid	Process	procid_target
PID 2396 wrote to memory of 2876	2396	51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe	29
PID 2396 wrote to memory of 2876	2396	51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe	29
PID 2396 wrote to memory of 2876	2396	51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe	29
PID 2396 wrote to memory of 2876	2396	51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe	29

C:\Users\Admin\AppData\Local\Temp\51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe
"C:\Users\Admin\AppData\Local\Temp\51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 36
  2⤵
  - Program crash
  PID:2876

memory/2396-0-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download