0a456f0fee171826bb44c9c2e1d5e7b95c0862b67d9dd75a843dec035224bb74

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:04

Target

0a456f0fee171826bb44c9c2e1d5e7b95c0862b67d9dd75a843dec035224bb74.exe
Size

355KB
MD5

f4fb6b518e2e550467f533124e1f80f4
SHA1

964e735dd9410e07536e46b9f50c65fed148bcd7
SHA256

0a456f0fee171826bb44c9c2e1d5e7b95c0862b67d9dd75a843dec035224bb74
SHA512

4a02aa8aa87dab5d6aa14da695f71aa424b95bc4437c3b8353ac355e0a73f68ded2df49e6e2ca8af6e9389745861a78a7343ab4838a6584a1108e18525d5984a
SSDEEP

6144:+vFPlgMF6peZUqbWFROY1NiXKvtuTx5qPmOGDe+VNfyhr24L25rQXxSXQMR23M:+9PlgMFgxy2u15emOqVNL4LQriM

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1820 1312 WerFault.exe 0a456f0fee171826bb44c9c2e1d5e7b95c0862b67d9dd75a843dec035224bb74.exe

pid	pid_target	process	target process
1820	1312	WerFault.exe	0a456f0fee171826bb44c9c2e1d5e7b95c0862b67d9dd75a843dec035224bb74.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0a456f0fee171826bb44c9c2e1d5e7b95c0862b67d9dd75a843dec035224bb74.exe

description	pid	process	target process
PID 1312 wrote to memory of 1820	1312	0a456f0fee171826bb44c9c2e1d5e7b95c0862b67d9dd75a843dec035224bb74.exe	WerFault.exe
PID 1312 wrote to memory of 1820	1312	0a456f0fee171826bb44c9c2e1d5e7b95c0862b67d9dd75a843dec035224bb74.exe	WerFault.exe
PID 1312 wrote to memory of 1820	1312	0a456f0fee171826bb44c9c2e1d5e7b95c0862b67d9dd75a843dec035224bb74.exe	WerFault.exe
PID 1312 wrote to memory of 1820	1312	0a456f0fee171826bb44c9c2e1d5e7b95c0862b67d9dd75a843dec035224bb74.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0a456f0fee171826bb44c9c2e1d5e7b95c0862b67d9dd75a843dec035224bb74.exe
"C:\Users\Admin\AppData\Local\Temp\0a456f0fee171826bb44c9c2e1d5e7b95c0862b67d9dd75a843dec035224bb74.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 48
2⤵
- Program crash
PID:1820

memory/1312-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1312-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download