e660be79de0932d6c5c0f1b65dc5d842ed790962625d5dd8731c30f46ae264a2

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 10:53

Target

1f1cdd32efd5cdc4a70d77af2754296f6ddbca64d78c083caa19118964d61da5.exe
Size

273KB
MD5

9eb90d3a283b6c0a51d202b34bce84d6
SHA1

3e17c2aa3112209da575be3ffc32e8afab044c15
SHA256

1f1cdd32efd5cdc4a70d77af2754296f6ddbca64d78c083caa19118964d61da5
SHA512

926ec63964194e962605a0a11eee363fc12039c81f2f693be27f6a1cae00411c8df7eee0efdd4ad5f9efd5d20abb4d12076ba18a57708b92879ea1ec9ecb9f25
SSDEEP

6144:aKePsi5kV1JFQRlai+JIPzazXQtZ8/6Xhk8MZe9a6n:HePs6pa5eTa/8VMKFn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2084	1612	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2084	1612	1f1cdd32efd5cdc4a70d77af2754296f6ddbca64d78c083caa19118964d61da5.exe	29
PID 1612 wrote to memory of 2084	1612	1f1cdd32efd5cdc4a70d77af2754296f6ddbca64d78c083caa19118964d61da5.exe	29
PID 1612 wrote to memory of 2084	1612	1f1cdd32efd5cdc4a70d77af2754296f6ddbca64d78c083caa19118964d61da5.exe	29
PID 1612 wrote to memory of 2084	1612	1f1cdd32efd5cdc4a70d77af2754296f6ddbca64d78c083caa19118964d61da5.exe	29

C:\Users\Admin\AppData\Local\Temp\1f1cdd32efd5cdc4a70d77af2754296f6ddbca64d78c083caa19118964d61da5.exe
"C:\Users\Admin\AppData\Local\Temp\1f1cdd32efd5cdc4a70d77af2754296f6ddbca64d78c083caa19118964d61da5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 72
  2⤵
  - Program crash
  PID:2084

memory/1612-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1612-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download