e660be79de0932d6c5c0f1b65dc5d842ed790962625d5dd8731c30f46ae264a2

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 10:53

Target

33277efd72a246f701b9c69dc414ee0ebab7e3cb5f576fa767dd942f09ac2dbf.exe
Size

273KB
MD5

c296de24cfb32f1d09275c9b40927968
SHA1

f6c706e5385f58f9c2d7a4d985939fba186cd516
SHA256

33277efd72a246f701b9c69dc414ee0ebab7e3cb5f576fa767dd942f09ac2dbf
SHA512

5ac2fb1b8ce388eb499bd5044e724a4e85eae9bad3fdb93c7442caf6741544e7a6c00c7b89902e2b899e0d8f9e2c5fbb099a651085bfad7ab7716fc28291497b
SSDEEP

6144:K3LM7xuP5m0WGhvTd8AvI9S3XXv2o+T5Zsf1SKMZa6n:eM7xkPPvrv2o+T5ISK+Fn

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2516 2168 WerFault.exe 33277efd72a246f701b9c69dc414ee0ebab7e3cb5f576fa767dd942f09ac2dbf.exe

pid	pid_target	process	target process
2516	2168	WerFault.exe	33277efd72a246f701b9c69dc414ee0ebab7e3cb5f576fa767dd942f09ac2dbf.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

33277efd72a246f701b9c69dc414ee0ebab7e3cb5f576fa767dd942f09ac2dbf.exe

description	pid	process	target process
PID 2168 wrote to memory of 2516	2168	33277efd72a246f701b9c69dc414ee0ebab7e3cb5f576fa767dd942f09ac2dbf.exe	WerFault.exe
PID 2168 wrote to memory of 2516	2168	33277efd72a246f701b9c69dc414ee0ebab7e3cb5f576fa767dd942f09ac2dbf.exe	WerFault.exe
PID 2168 wrote to memory of 2516	2168	33277efd72a246f701b9c69dc414ee0ebab7e3cb5f576fa767dd942f09ac2dbf.exe	WerFault.exe
PID 2168 wrote to memory of 2516	2168	33277efd72a246f701b9c69dc414ee0ebab7e3cb5f576fa767dd942f09ac2dbf.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\33277efd72a246f701b9c69dc414ee0ebab7e3cb5f576fa767dd942f09ac2dbf.exe
"C:\Users\Admin\AppData\Local\Temp\33277efd72a246f701b9c69dc414ee0ebab7e3cb5f576fa767dd942f09ac2dbf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 52
  2⤵
  - Program crash
  PID:2516

memory/2168-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2168-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download