d929db0b4de9bed4c0750ad10440c81484f64e1f308689c0c56cdbe1bfe63b39

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 15:42

Target

9e375a6be43c6fb35a506cdbbab7a9291cd783ccc69adf51e1cf73f8e1c949d0.exe
Size

332KB
MD5

1ca532db776dbb27e5a6fcbee57de507
SHA1

4e4e348a558dd67d25b6b74fb10716a341ed9e22
SHA256

9e375a6be43c6fb35a506cdbbab7a9291cd783ccc69adf51e1cf73f8e1c949d0
SHA512

865c63487816ec1d44fa10f45e29807e18de7d23d6062ca8c4000626d685948ac12c08f3fdf0d5e5c1bd84c8d89f096465ee7a3b7d2114ae7c9887e307eabf1a
SSDEEP

6144:z3Lw7HV0BJJoa1L+ZBYo5+fR+yghj6Q5KBoxBG9jA4Su7xiKgW2+0Xp:zbBBJJoa1LfSyg5lKkujsu7QKl0Xp

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1532 1820 WerFault.exe 9e375a6be43c6fb35a506cdbbab7a9291cd783ccc69adf51e1cf73f8e1c949d0.exe

pid	pid_target	process	target process
1532	1820	WerFault.exe	9e375a6be43c6fb35a506cdbbab7a9291cd783ccc69adf51e1cf73f8e1c949d0.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9e375a6be43c6fb35a506cdbbab7a9291cd783ccc69adf51e1cf73f8e1c949d0.exe

description	pid	process	target process
PID 1820 wrote to memory of 1532	1820	9e375a6be43c6fb35a506cdbbab7a9291cd783ccc69adf51e1cf73f8e1c949d0.exe	WerFault.exe
PID 1820 wrote to memory of 1532	1820	9e375a6be43c6fb35a506cdbbab7a9291cd783ccc69adf51e1cf73f8e1c949d0.exe	WerFault.exe
PID 1820 wrote to memory of 1532	1820	9e375a6be43c6fb35a506cdbbab7a9291cd783ccc69adf51e1cf73f8e1c949d0.exe	WerFault.exe
PID 1820 wrote to memory of 1532	1820	9e375a6be43c6fb35a506cdbbab7a9291cd783ccc69adf51e1cf73f8e1c949d0.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9e375a6be43c6fb35a506cdbbab7a9291cd783ccc69adf51e1cf73f8e1c949d0.exe
"C:\Users\Admin\AppData\Local\Temp\9e375a6be43c6fb35a506cdbbab7a9291cd783ccc69adf51e1cf73f8e1c949d0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 52
2⤵
- Program crash
PID:1532

memory/1820-0-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/1820-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download