15da805913716df9c587eca175c626571489f023cb679b69ed646c3e95ab5567

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 11:47

Target

4111ebb7fae57f66063a32adb1209c583eab0ef408bb86ce4daf6bf2884c1225.exe
Size

1.2MB
MD5

b7a68c907aedd472561612e4c3349bfb
SHA1

84a0569640f30c74b1109f13aed881f4d1fdbfc2
SHA256

4111ebb7fae57f66063a32adb1209c583eab0ef408bb86ce4daf6bf2884c1225
SHA512

1b14117e9b58a07ad26270e83aa90510f2febaaf6e9889c68fabf961205ec9890f45db5f5a41100df12ace34475205df6aeda28470a48b68b276cfb336b34252
SSDEEP

24576:yBXCi7JIK8li6v93OhlvTMsY5BeDU8zwcXbig8mqOs7s:yBSJli6v93OLih8z5LIV7s

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2424	2460	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2424	2460	4111ebb7fae57f66063a32adb1209c583eab0ef408bb86ce4daf6bf2884c1225.exe	29
PID 2460 wrote to memory of 2424	2460	4111ebb7fae57f66063a32adb1209c583eab0ef408bb86ce4daf6bf2884c1225.exe	29
PID 2460 wrote to memory of 2424	2460	4111ebb7fae57f66063a32adb1209c583eab0ef408bb86ce4daf6bf2884c1225.exe	29
PID 2460 wrote to memory of 2424	2460	4111ebb7fae57f66063a32adb1209c583eab0ef408bb86ce4daf6bf2884c1225.exe	29

C:\Users\Admin\AppData\Local\Temp\4111ebb7fae57f66063a32adb1209c583eab0ef408bb86ce4daf6bf2884c1225.exe
"C:\Users\Admin\AppData\Local\Temp\4111ebb7fae57f66063a32adb1209c583eab0ef408bb86ce4daf6bf2884c1225.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 52
  2⤵
  - Program crash
  PID:2424

memory/2460-0-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2460-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download