d929db0b4de9bed4c0750ad10440c81484f64e1f308689c0c56cdbe1bfe63b39

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 15:42

Target

8167afa4960bf7ec3e9ccea8204567bf3c18d20b72fe034ca2fe482d19f96f61.exe
Size

1.2MB
MD5

1a8a91c41fbdc6ee93cc46c3f734ccc7
SHA1

fadc036ad42baecea7804bd20440a69bd7cee491
SHA256

8167afa4960bf7ec3e9ccea8204567bf3c18d20b72fe034ca2fe482d19f96f61
SHA512

3cf0ccad0bde2673352baeef3777e102469ce31424034137041987112a1314ad410e7617886914cf8febd3ef2a7f9d7b5cb717236581fda0b9555665c2d53fed
SSDEEP

24576:BmBaiRH28+VLmn1zWVrWhMs2ehVDWsK+t3h5mTdOs:Bm8XVLmn1zW4VSdoWdOs

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1748	2988	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8167afa4960bf7ec3e9ccea8204567bf3c18d20b72fe034ca2fe482d19f96f61.exe

description	pid	Process	procid_target
PID 2988 wrote to memory of 1748	2988	8167afa4960bf7ec3e9ccea8204567bf3c18d20b72fe034ca2fe482d19f96f61.exe	29
PID 2988 wrote to memory of 1748	2988	8167afa4960bf7ec3e9ccea8204567bf3c18d20b72fe034ca2fe482d19f96f61.exe	29
PID 2988 wrote to memory of 1748	2988	8167afa4960bf7ec3e9ccea8204567bf3c18d20b72fe034ca2fe482d19f96f61.exe	29
PID 2988 wrote to memory of 1748	2988	8167afa4960bf7ec3e9ccea8204567bf3c18d20b72fe034ca2fe482d19f96f61.exe	29

C:\Users\Admin\AppData\Local\Temp\8167afa4960bf7ec3e9ccea8204567bf3c18d20b72fe034ca2fe482d19f96f61.exe
"C:\Users\Admin\AppData\Local\Temp\8167afa4960bf7ec3e9ccea8204567bf3c18d20b72fe034ca2fe482d19f96f61.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 52
  2⤵
  - Program crash
  PID:1748

memory/2988-0-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2988-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download