db3e9f5cc28df4c7c2b887a7984b4cc0ba7440fd4a8cb745f4a62b00fbd4334f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:38

Target

db3e9f5cc28df4c7c2b887a7984b4cc0ba7440fd4a8cb745f4a62b00fbd4334f.exe
Size

10.0MB
MD5

a02a5e4482514a29195a4a4a43a44980
SHA1

622ec9962dec244327cf26da1f7d5af33aaa3744
SHA256

db3e9f5cc28df4c7c2b887a7984b4cc0ba7440fd4a8cb745f4a62b00fbd4334f
SHA512

dcaae9c2d194fd8d4b7a5d55273bf048a5d68cdf5b33444987b1a916af0aec5a92babf6341f0269d09d7c6aa91d8d73db19e24b5914f96d6e157c9d83cb6fa62
SSDEEP

196608:x5IGEqaD1X3ANRAFLSayFnE5ck3rbgwlZJj7PRVUL/4lgCu44KUJNoIIu:LfESNRAzsnxk3rbgGZJjLRVimNu4472M

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2236 1724 WerFault.exe db3e9f5cc28df4c7c2b887a7984b4cc0ba7440fd4a8cb745f4a62b00fbd4334f.exe

pid	pid_target	process	target process
2236	1724	WerFault.exe	db3e9f5cc28df4c7c2b887a7984b4cc0ba7440fd4a8cb745f4a62b00fbd4334f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

db3e9f5cc28df4c7c2b887a7984b4cc0ba7440fd4a8cb745f4a62b00fbd4334f.exe

description	pid	process	target process
PID 1724 wrote to memory of 2236	1724	db3e9f5cc28df4c7c2b887a7984b4cc0ba7440fd4a8cb745f4a62b00fbd4334f.exe	WerFault.exe
PID 1724 wrote to memory of 2236	1724	db3e9f5cc28df4c7c2b887a7984b4cc0ba7440fd4a8cb745f4a62b00fbd4334f.exe	WerFault.exe
PID 1724 wrote to memory of 2236	1724	db3e9f5cc28df4c7c2b887a7984b4cc0ba7440fd4a8cb745f4a62b00fbd4334f.exe	WerFault.exe
PID 1724 wrote to memory of 2236	1724	db3e9f5cc28df4c7c2b887a7984b4cc0ba7440fd4a8cb745f4a62b00fbd4334f.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\db3e9f5cc28df4c7c2b887a7984b4cc0ba7440fd4a8cb745f4a62b00fbd4334f.exe
"C:\Users\Admin\AppData\Local\Temp\db3e9f5cc28df4c7c2b887a7984b4cc0ba7440fd4a8cb745f4a62b00fbd4334f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 36
2⤵
- Program crash
PID:2236

memory/1724-0-0x0000000000400000-0x000000000183A000-memory.dmp

Filesize
20.2MB

Download
memory/1724-1-0x0000000000400000-0x000000000183A000-memory.dmp

Filesize
20.2MB

Download