132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:08

Target

132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf.exe
Size

459KB
MD5

e154829a16292c782b579d217e0ea8bf
SHA1

5d2fb1535930184e7212b5fb780c638f32a03cee
SHA256

132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf
SHA512

d0acbc1d810f628107e095959a2c53ef6e58adcc8631f1ab16353b1294b7f51f13b1ff9936ab5e86aff2d3c4fad9c56f3df263d9f7b27de8ffa3cd508537a300
SSDEEP

12288:mQJRsrrQqYvbeUVOyJ3GJNu0ADIJTls9tJBKM1I59rM:akkyJoNYDOsrqM259A

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

528 2180 WerFault.exe 132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf.exe

pid	pid_target	process	target process
528	2180	WerFault.exe	132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf.exe

description	pid	process	target process
PID 2180 wrote to memory of 528	2180	132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf.exe	WerFault.exe
PID 2180 wrote to memory of 528	2180	132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf.exe	WerFault.exe
PID 2180 wrote to memory of 528	2180	132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf.exe	WerFault.exe
PID 2180 wrote to memory of 528	2180	132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf.exe
"C:\Users\Admin\AppData\Local\Temp\132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 48
2⤵
- Program crash
PID:528

memory/2180-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2180-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download