36a33e7da8ad27ce449d6bc53c6ca650bc283b8f96d5fe797187aea40e0dcc68

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 05:30

Target

4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe
Size

306KB
MD5

d41a5cd7a3a7870992cfd75c5eff1637
SHA1

8365910e5f8fff802cd8d928351270432128abaa
SHA256

4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b
SHA512

893c73fe37c917bf3c8557c1344e03daef3d1264a0296847fbd5e667e0070b6c920a58f709ec96bb2c1afd22a485d366479f57911eb5073e4c77e6f43243604e
SSDEEP

6144:vBZd9vSWh60RVAtljy11yiI8iz2jaYO9eGoW/JyL985:JZiWhHE4i6qfRyL985

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1260 1244 WerFault.exe 4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe

pid	pid_target	process	target process
1260	1244	WerFault.exe	4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe

description	pid	process	target process
PID 1244 wrote to memory of 1260	1244	4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe	WerFault.exe
PID 1244 wrote to memory of 1260	1244	4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe	WerFault.exe
PID 1244 wrote to memory of 1260	1244	4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe	WerFault.exe
PID 1244 wrote to memory of 1260	1244	4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe
"C:\Users\Admin\AppData\Local\Temp\4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 88
  2⤵
  - Program crash
  PID:1260

memory/1244-0-0x00000000013D8000-0x00000000013D9000-memory.dmp

Filesize
4KB

Download