69298b4215ffa9e41ccbf67608706d3cf967cf279556e49da7a44c9e9b58aac2

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:45

Target

69298b4215ffa9e41ccbf67608706d3cf967cf279556e49da7a44c9e9b58aac2.exe
Size

1.7MB
MD5

a2daac8922ba486976e13e5610ecaba6
SHA1

aa1c836329d23d705c8f8512013f9757ea220626
SHA256

69298b4215ffa9e41ccbf67608706d3cf967cf279556e49da7a44c9e9b58aac2
SHA512

86e8e7f02db080bc303ab207bd138cd12cd2fa8932141d8c7b6e3f96fb04023db82f3f4b3459b60f6b7b41e5d307f90845dfcb637ec0c4638152c5b90169947e
SSDEEP

49152:ON4eN4pIVTLlpYIHlVwQHNu6hdLIS0zR:yJRp1Hl9tuiFX0

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1220 2860 WerFault.exe 69298b4215ffa9e41ccbf67608706d3cf967cf279556e49da7a44c9e9b58aac2.exe

pid	pid_target	process	target process
1220	2860	WerFault.exe	69298b4215ffa9e41ccbf67608706d3cf967cf279556e49da7a44c9e9b58aac2.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

69298b4215ffa9e41ccbf67608706d3cf967cf279556e49da7a44c9e9b58aac2.exe

description	pid	process	target process
PID 2860 wrote to memory of 1220	2860	69298b4215ffa9e41ccbf67608706d3cf967cf279556e49da7a44c9e9b58aac2.exe	WerFault.exe
PID 2860 wrote to memory of 1220	2860	69298b4215ffa9e41ccbf67608706d3cf967cf279556e49da7a44c9e9b58aac2.exe	WerFault.exe
PID 2860 wrote to memory of 1220	2860	69298b4215ffa9e41ccbf67608706d3cf967cf279556e49da7a44c9e9b58aac2.exe	WerFault.exe
PID 2860 wrote to memory of 1220	2860	69298b4215ffa9e41ccbf67608706d3cf967cf279556e49da7a44c9e9b58aac2.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\69298b4215ffa9e41ccbf67608706d3cf967cf279556e49da7a44c9e9b58aac2.exe
"C:\Users\Admin\AppData\Local\Temp\69298b4215ffa9e41ccbf67608706d3cf967cf279556e49da7a44c9e9b58aac2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 632
2⤵
- Program crash
PID:1220

memory/2860-0-0x000000007462E000-0x000000007462F000-memory.dmp

Filesize
4KB

Download
memory/2860-1-0x0000000001160000-0x0000000001310000-memory.dmp

Filesize
1.7MB

Download
memory/2860-2-0x0000000074620000-0x0000000074D0E000-memory.dmp

Filesize
6.9MB

Download
memory/2860-3-0x0000000074620000-0x0000000074D0E000-memory.dmp

Filesize
6.9MB

Download