718f3ddfb33000759e207ae9f4b3118b34ce44f794749993f660fdcdf4dab027

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:50

Target

718f3ddfb33000759e207ae9f4b3118b34ce44f794749993f660fdcdf4dab027.exe
Size

423KB
MD5

5afb193b8db7087705eca19e6fd17350
SHA1

961d484614c96070af1d5ba640899f4f95b64bba
SHA256

718f3ddfb33000759e207ae9f4b3118b34ce44f794749993f660fdcdf4dab027
SHA512

197c06628f4b2f2298639a77116a886e949cea574f86d217eed7421430fa7f02504bb9a2e1c6a29a0b2d306d12c7fbd1e3ecbeef60fcedc67cd6bb25c42709c7
SSDEEP

6144:0qiuRraHLIo4V1p+a3VyZJ1PGor3dz1UKwETicnDQNk3KRks2P4f3P5CDaZwAZB6:6HLIoCo1zzNiKwEjnMCKRdH5o1AZm

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1980 2164 WerFault.exe 718f3ddfb33000759e207ae9f4b3118b34ce44f794749993f660fdcdf4dab027.exe

pid	pid_target	process	target process
1980	2164	WerFault.exe	718f3ddfb33000759e207ae9f4b3118b34ce44f794749993f660fdcdf4dab027.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

718f3ddfb33000759e207ae9f4b3118b34ce44f794749993f660fdcdf4dab027.exe

description	pid	process	target process
PID 2164 wrote to memory of 1980	2164	718f3ddfb33000759e207ae9f4b3118b34ce44f794749993f660fdcdf4dab027.exe	WerFault.exe
PID 2164 wrote to memory of 1980	2164	718f3ddfb33000759e207ae9f4b3118b34ce44f794749993f660fdcdf4dab027.exe	WerFault.exe
PID 2164 wrote to memory of 1980	2164	718f3ddfb33000759e207ae9f4b3118b34ce44f794749993f660fdcdf4dab027.exe	WerFault.exe
PID 2164 wrote to memory of 1980	2164	718f3ddfb33000759e207ae9f4b3118b34ce44f794749993f660fdcdf4dab027.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\718f3ddfb33000759e207ae9f4b3118b34ce44f794749993f660fdcdf4dab027.exe
"C:\Users\Admin\AppData\Local\Temp\718f3ddfb33000759e207ae9f4b3118b34ce44f794749993f660fdcdf4dab027.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 72
2⤵
- Program crash
PID:1980

memory/2164-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2164-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download