b7ac4c2bf9e7750e0f37ce0a7601357719d44f526f5eb7c18c62b7e509b7bf27

Analysis

max time kernel
4s
max time network
0s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:09

Target

Setup.exe
Size

466KB
MD5

a45fcbd4b430c4fd4ee740f8822adbaa
SHA1

714deba8f75ce7ffa63d4d44ae0b836d41a53ffe
SHA256

b7ac4c2bf9e7750e0f37ce0a7601357719d44f526f5eb7c18c62b7e509b7bf27
SHA512

8d682225e25da1e93ad2afe6fb0d4f05774c986e6758b0f16c10910c5be623433748f22f7ef76cf450ed1d5668515aa0c347e0adc1401fe6e06ebdf0806cf0ec
SSDEEP

6144:Qdb/Q+n2NgF7CcdUbzMA+tV+J38qF+qw6nBMQyepZmEL2KaKQyabo2E1VnUZm+oc:Qd/Q+cQ2w+J3VFu6nBHye9VaMbtUhMM

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2000 2040 WerFault.exe Setup.exe

pid	pid_target	process	target process
2000	2040	WerFault.exe	Setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 2040 wrote to memory of 2000	2040	Setup.exe	WerFault.exe
PID 2040 wrote to memory of 2000	2040	Setup.exe	WerFault.exe
PID 2040 wrote to memory of 2000	2040	Setup.exe	WerFault.exe
PID 2040 wrote to memory of 2000	2040	Setup.exe	WerFault.exe
PID 2040 wrote to memory of 2000	2040	Setup.exe	WerFault.exe
PID 2040 wrote to memory of 2000	2040	Setup.exe	WerFault.exe
PID 2040 wrote to memory of 2000	2040	Setup.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 256
  2⤵
  - Program crash
  PID:2000

memory/2040-0-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2040-1-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download