12e49cc112a90fff9daff634e52f6b61ae5e64b212821d39b309e89a4bf46abb

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:07

Target

12e49cc112a90fff9daff634e52f6b61ae5e64b212821d39b309e89a4bf46abb.exe
Size

771KB
MD5

a2922022070dbb7a436653386ab18968
SHA1

b567533b55e0cbd76128ffbb38071ffa6af91a11
SHA256

12e49cc112a90fff9daff634e52f6b61ae5e64b212821d39b309e89a4bf46abb
SHA512

9d50129de7313aa64c0550dee0fa8d1f1548f68d684bd2b37055671384b7e964b898d20d73feb56dd796ed068f76aa4e7e2181ec5faa035d24ad31fff9ba56d3
SSDEEP

12288:tW6Yma8p5EL2cJtvn89qyOVJ3yYs31HlpsxXivzN1/n1voqpcKyzPxkR:IZmaYi2mvn8rOVJ3bKiivz7P1vJcKyQ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2172 2136 WerFault.exe 12e49cc112a90fff9daff634e52f6b61ae5e64b212821d39b309e89a4bf46abb.exe

pid	pid_target	process	target process
2172	2136	WerFault.exe	12e49cc112a90fff9daff634e52f6b61ae5e64b212821d39b309e89a4bf46abb.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

12e49cc112a90fff9daff634e52f6b61ae5e64b212821d39b309e89a4bf46abb.exe

description	pid	process	target process
PID 2136 wrote to memory of 2172	2136	12e49cc112a90fff9daff634e52f6b61ae5e64b212821d39b309e89a4bf46abb.exe	WerFault.exe
PID 2136 wrote to memory of 2172	2136	12e49cc112a90fff9daff634e52f6b61ae5e64b212821d39b309e89a4bf46abb.exe	WerFault.exe
PID 2136 wrote to memory of 2172	2136	12e49cc112a90fff9daff634e52f6b61ae5e64b212821d39b309e89a4bf46abb.exe	WerFault.exe
PID 2136 wrote to memory of 2172	2136	12e49cc112a90fff9daff634e52f6b61ae5e64b212821d39b309e89a4bf46abb.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\12e49cc112a90fff9daff634e52f6b61ae5e64b212821d39b309e89a4bf46abb.exe
"C:\Users\Admin\AppData\Local\Temp\12e49cc112a90fff9daff634e52f6b61ae5e64b212821d39b309e89a4bf46abb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 656
2⤵
- Program crash
PID:2172

memory/2136-0-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

Filesize
4KB

Download
memory/2136-1-0x00000000012D0000-0x0000000001394000-memory.dmp

Filesize
784KB

Download
memory/2136-2-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/2136-3-0x0000000004F30000-0x0000000004FF0000-memory.dmp

Filesize
768KB

Download
memory/2136-4-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

Filesize
4KB

Download
memory/2136-5-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download