36a33e7da8ad27ce449d6bc53c6ca650bc283b8f96d5fe797187aea40e0dcc68

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 05:30

Target

236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe
Size

694KB
MD5

c8032b42738527a70de1dadc4a7bff5b
SHA1

f5f778df15d4e14503bea0f654cf9427ba050a38
SHA256

236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5
SHA512

babddfaac51c11952a79047852b01c499075acfe24e91dac46a5c590a31be1e4e71df5b1daf27254d9d608fa7345839790f8a550e04392de7f625c5d6b22a97d
SSDEEP

12288:OO0Jg3ZJ7hWFArUqHsjumNFcF9gopM3bcgsqV5P3JkTC:OJJU7hWFuHyumzcCLUqV5v0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3028	3008	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 3028	3008	236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe	29
PID 3008 wrote to memory of 3028	3008	236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe	29
PID 3008 wrote to memory of 3028	3008	236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe	29
PID 3008 wrote to memory of 3028	3008	236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe	29

C:\Users\Admin\AppData\Local\Temp\236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe
"C:\Users\Admin\AppData\Local\Temp\236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 128
  2⤵
  - Program crash
  PID:3028

memory/3008-0-0x0000000000130000-0x000000000017D000-memory.dmp

Filesize
308KB

Download
memory/3008-5-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download