d929db0b4de9bed4c0750ad10440c81484f64e1f308689c0c56cdbe1bfe63b39

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 06:19

Target

9e375a6be43c6fb35a506cdbbab7a9291cd783ccc69adf51e1cf73f8e1c949d0.exe
Size

332KB
MD5

1ca532db776dbb27e5a6fcbee57de507
SHA1

4e4e348a558dd67d25b6b74fb10716a341ed9e22
SHA256

9e375a6be43c6fb35a506cdbbab7a9291cd783ccc69adf51e1cf73f8e1c949d0
SHA512

865c63487816ec1d44fa10f45e29807e18de7d23d6062ca8c4000626d685948ac12c08f3fdf0d5e5c1bd84c8d89f096465ee7a3b7d2114ae7c9887e307eabf1a
SSDEEP

6144:z3Lw7HV0BJJoa1L+ZBYo5+fR+yghj6Q5KBoxBG9jA4Su7xiKgW2+0Xp:zbBBJJoa1LfSyg5lKkujsu7QKl0Xp

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1732 2944 WerFault.exe 9e375a6be43c6fb35a506cdbbab7a9291cd783ccc69adf51e1cf73f8e1c949d0.exe

pid	pid_target	process	target process
1732	2944	WerFault.exe	9e375a6be43c6fb35a506cdbbab7a9291cd783ccc69adf51e1cf73f8e1c949d0.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9e375a6be43c6fb35a506cdbbab7a9291cd783ccc69adf51e1cf73f8e1c949d0.exe

description	pid	process	target process
PID 2944 wrote to memory of 1732	2944	9e375a6be43c6fb35a506cdbbab7a9291cd783ccc69adf51e1cf73f8e1c949d0.exe	WerFault.exe
PID 2944 wrote to memory of 1732	2944	9e375a6be43c6fb35a506cdbbab7a9291cd783ccc69adf51e1cf73f8e1c949d0.exe	WerFault.exe
PID 2944 wrote to memory of 1732	2944	9e375a6be43c6fb35a506cdbbab7a9291cd783ccc69adf51e1cf73f8e1c949d0.exe	WerFault.exe
PID 2944 wrote to memory of 1732	2944	9e375a6be43c6fb35a506cdbbab7a9291cd783ccc69adf51e1cf73f8e1c949d0.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9e375a6be43c6fb35a506cdbbab7a9291cd783ccc69adf51e1cf73f8e1c949d0.exe
"C:\Users\Admin\AppData\Local\Temp\9e375a6be43c6fb35a506cdbbab7a9291cd783ccc69adf51e1cf73f8e1c949d0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 52
  2⤵
  - Program crash
  PID:1732

memory/2944-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2944-0-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download