15da805913716df9c587eca175c626571489f023cb679b69ed646c3e95ab5567

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 11:47

Target

3ee99efba0a08acf1fb339b90e092de6608570d79e9eab1c5b99e8734c43eb30.exe
Size

368KB
MD5

bab4b0f37de3c278af5a7709e98672cd
SHA1

6b382dcdadacd3b98c4fe2851b9b7cc3e92507f4
SHA256

3ee99efba0a08acf1fb339b90e092de6608570d79e9eab1c5b99e8734c43eb30
SHA512

ef5f03e1ff39b0e6371f684655e5023dc437cd38f5145c5e070d0fbb3801aa967b5bfa7c74030b178564bd22d1287738b12b2c1b58c8880cb0a5d94aaa8ed0f7
SSDEEP

6144:BOG9AjZTg9JRdYLdiYFv/hiKGWDDT7IKkttUyAYLJonoTHwg+spt:UQA+9IvAKtPQPxlOno6spt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2984	2456	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2984	2456	3ee99efba0a08acf1fb339b90e092de6608570d79e9eab1c5b99e8734c43eb30.exe	29
PID 2456 wrote to memory of 2984	2456	3ee99efba0a08acf1fb339b90e092de6608570d79e9eab1c5b99e8734c43eb30.exe	29
PID 2456 wrote to memory of 2984	2456	3ee99efba0a08acf1fb339b90e092de6608570d79e9eab1c5b99e8734c43eb30.exe	29
PID 2456 wrote to memory of 2984	2456	3ee99efba0a08acf1fb339b90e092de6608570d79e9eab1c5b99e8734c43eb30.exe	29

C:\Users\Admin\AppData\Local\Temp\3ee99efba0a08acf1fb339b90e092de6608570d79e9eab1c5b99e8734c43eb30.exe
"C:\Users\Admin\AppData\Local\Temp\3ee99efba0a08acf1fb339b90e092de6608570d79e9eab1c5b99e8734c43eb30.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 52
  2⤵
  - Program crash
  PID:2984

memory/2456-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2456-0-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download