fc0a70936e6485ae0ce312ce6ff394d0d21759de4bc9ea9b5e01544d951535c2

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 10:00

Target

2743aa58ac87e72c969f8baff90a46df51144db6b46e42137bec8f8ffe030422.exe
Size

208KB
MD5

3939a18c836b8e41a6f4e358002de48d
SHA1

13750e204ac84b63fd447cb28f42b8ac8e25033d
SHA256

2743aa58ac87e72c969f8baff90a46df51144db6b46e42137bec8f8ffe030422
SHA512

ab203e30ee850fbb4a3fdae2dda8769597ec96729578f55e61c1fe89e31de23c86f9ae1ca7904a9c5c53dc2c3c3d30096f2da0a220ab2838e923926faf1d7f1f
SSDEEP

3072:KUszX+YhFJOIwz9jnJTvT8GiJIl1yVuTolD3oc+DVWGQ+BsQEp6svwqJSo6BLMs/:TiOYfJDk998JIXygbHXQ+BsQvsv4espF

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2148 2084 WerFault.exe 2743aa58ac87e72c969f8baff90a46df51144db6b46e42137bec8f8ffe030422.exe

pid	pid_target	process	target process
2148	2084	WerFault.exe	2743aa58ac87e72c969f8baff90a46df51144db6b46e42137bec8f8ffe030422.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2743aa58ac87e72c969f8baff90a46df51144db6b46e42137bec8f8ffe030422.exe

description	pid	process	target process
PID 2084 wrote to memory of 2148	2084	2743aa58ac87e72c969f8baff90a46df51144db6b46e42137bec8f8ffe030422.exe	WerFault.exe
PID 2084 wrote to memory of 2148	2084	2743aa58ac87e72c969f8baff90a46df51144db6b46e42137bec8f8ffe030422.exe	WerFault.exe
PID 2084 wrote to memory of 2148	2084	2743aa58ac87e72c969f8baff90a46df51144db6b46e42137bec8f8ffe030422.exe	WerFault.exe
PID 2084 wrote to memory of 2148	2084	2743aa58ac87e72c969f8baff90a46df51144db6b46e42137bec8f8ffe030422.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2743aa58ac87e72c969f8baff90a46df51144db6b46e42137bec8f8ffe030422.exe
"C:\Users\Admin\AppData\Local\Temp\2743aa58ac87e72c969f8baff90a46df51144db6b46e42137bec8f8ffe030422.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 52
2⤵
- Program crash
PID:2148

memory/2084-0-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2084-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download