01ffe49f3718dcb41ddd63aadd76a3bd342de6f7549697033325830828bcfdf7

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 22:32

Target

01ffe49f3718dcb41ddd63aadd76a3bd342de6f7549697033325830828bcfdf7.exe
Size

313KB
MD5

b99a7c6c9e6a2eb2945d894b2ce2c63b
SHA1

e09a2fecf1f27cc81a585c1c68d5deb792162118
SHA256

01ffe49f3718dcb41ddd63aadd76a3bd342de6f7549697033325830828bcfdf7
SHA512

f3b5c5699a5af49b1f46b0eada0f04574321723b3e26a86ec09ca1debcee9849e81e04d293e092dcab7e7fb08aa17dc14c8b3c0cec563c45edb89d80742fde57
SSDEEP

6144:0q+vsBU5EVVJlAD7yB87RU4t76wKmvlerJ9e9a6n:R+vs6TJ+U0rwFn

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2120	2020	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

01ffe49f3718dcb41ddd63aadd76a3bd342de6f7549697033325830828bcfdf7.exe

description	pid	Process	procid_target
PID 2020 wrote to memory of 2120	2020	01ffe49f3718dcb41ddd63aadd76a3bd342de6f7549697033325830828bcfdf7.exe	29
PID 2020 wrote to memory of 2120	2020	01ffe49f3718dcb41ddd63aadd76a3bd342de6f7549697033325830828bcfdf7.exe	29
PID 2020 wrote to memory of 2120	2020	01ffe49f3718dcb41ddd63aadd76a3bd342de6f7549697033325830828bcfdf7.exe	29
PID 2020 wrote to memory of 2120	2020	01ffe49f3718dcb41ddd63aadd76a3bd342de6f7549697033325830828bcfdf7.exe	29

C:\Users\Admin\AppData\Local\Temp\01ffe49f3718dcb41ddd63aadd76a3bd342de6f7549697033325830828bcfdf7.exe
"C:\Users\Admin\AppData\Local\Temp\01ffe49f3718dcb41ddd63aadd76a3bd342de6f7549697033325830828bcfdf7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 72
  2⤵
  - Program crash
  PID:2120

memory/2020-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2020-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download