0e4673760c64a0792815f9d9562f47346818e54eb29cf1e1d39410fca5f8e00c

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 20:57

Target

0e4673760c64a0792815f9d9562f47346818e54eb29cf1e1d39410fca5f8e00c.exe
Size

423KB
MD5

11cb6973434f9c3d70775b9c8fbf048b
SHA1

e3b4918d477e0bcc9a6da4ca9eef0c960ec32278
SHA256

0e4673760c64a0792815f9d9562f47346818e54eb29cf1e1d39410fca5f8e00c
SHA512

428d5c125cc9552e90303bad79762f600b8f45618c852c88ca2c71f5f3eccdebdc7e669df3da97c5bdc8d7aa2e442a4aee2c88e3cf741c092ab4324c0174f0fa
SSDEEP

6144:tqiWRrCHLIo4V1p+a3VyTJQgCb5ntM03fkJSWcUquA+Mb26:/HLIoCmQfntL3fkJDcUq3+

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2816 2964 WerFault.exe 0e4673760c64a0792815f9d9562f47346818e54eb29cf1e1d39410fca5f8e00c.exe

pid	pid_target	process	target process
2816	2964	WerFault.exe	0e4673760c64a0792815f9d9562f47346818e54eb29cf1e1d39410fca5f8e00c.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0e4673760c64a0792815f9d9562f47346818e54eb29cf1e1d39410fca5f8e00c.exe

description	pid	process	target process
PID 2964 wrote to memory of 2816	2964	0e4673760c64a0792815f9d9562f47346818e54eb29cf1e1d39410fca5f8e00c.exe	WerFault.exe
PID 2964 wrote to memory of 2816	2964	0e4673760c64a0792815f9d9562f47346818e54eb29cf1e1d39410fca5f8e00c.exe	WerFault.exe
PID 2964 wrote to memory of 2816	2964	0e4673760c64a0792815f9d9562f47346818e54eb29cf1e1d39410fca5f8e00c.exe	WerFault.exe
PID 2964 wrote to memory of 2816	2964	0e4673760c64a0792815f9d9562f47346818e54eb29cf1e1d39410fca5f8e00c.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0e4673760c64a0792815f9d9562f47346818e54eb29cf1e1d39410fca5f8e00c.exe
"C:\Users\Admin\AppData\Local\Temp\0e4673760c64a0792815f9d9562f47346818e54eb29cf1e1d39410fca5f8e00c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 72
2⤵
- Program crash
PID:2816

memory/2964-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2964-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download