e19e97a334ecb39058fd976080222a46cc2159e34c85df371a9eaf0088ee80eb

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 10:44

Target

410e72302dee0862e82d58671c8a130371c31bc22e8fb1bdd2afad927b1716e8.exe
Size

265KB
MD5

ad98e1aeaa299bdb2621db119060b32d
SHA1

77ab9d8e907f7745b9acf9f193ca59bdee47ac7c
SHA256

410e72302dee0862e82d58671c8a130371c31bc22e8fb1bdd2afad927b1716e8
SHA512

52a6eeba774bd755282bd7d465945288a8270d1dc1b8ec2734c1fdac90a681df8c0585fae38f54e466ffe822b670098e2c9efdfdfb1ab4669e47032f920b54a7
SSDEEP

6144:PZrHgDcXDXO5TGgwAEQSFQD9zqiL07Sowa6up:PZHgDcCqFQDRxoBw/up

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2588 1712 WerFault.exe 410e72302dee0862e82d58671c8a130371c31bc22e8fb1bdd2afad927b1716e8.exe

pid	pid_target	process	target process
2588	1712	WerFault.exe	410e72302dee0862e82d58671c8a130371c31bc22e8fb1bdd2afad927b1716e8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

410e72302dee0862e82d58671c8a130371c31bc22e8fb1bdd2afad927b1716e8.exe

description	pid	process	target process
PID 1712 wrote to memory of 2588	1712	410e72302dee0862e82d58671c8a130371c31bc22e8fb1bdd2afad927b1716e8.exe	WerFault.exe
PID 1712 wrote to memory of 2588	1712	410e72302dee0862e82d58671c8a130371c31bc22e8fb1bdd2afad927b1716e8.exe	WerFault.exe
PID 1712 wrote to memory of 2588	1712	410e72302dee0862e82d58671c8a130371c31bc22e8fb1bdd2afad927b1716e8.exe	WerFault.exe
PID 1712 wrote to memory of 2588	1712	410e72302dee0862e82d58671c8a130371c31bc22e8fb1bdd2afad927b1716e8.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\410e72302dee0862e82d58671c8a130371c31bc22e8fb1bdd2afad927b1716e8.exe
"C:\Users\Admin\AppData\Local\Temp\410e72302dee0862e82d58671c8a130371c31bc22e8fb1bdd2afad927b1716e8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 48
  2⤵
  - Program crash
  PID:2588

memory/1712-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1712-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download