132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 13:46

Target

132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf.exe
Size

459KB
MD5

e154829a16292c782b579d217e0ea8bf
SHA1

5d2fb1535930184e7212b5fb780c638f32a03cee
SHA256

132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf
SHA512

d0acbc1d810f628107e095959a2c53ef6e58adcc8631f1ab16353b1294b7f51f13b1ff9936ab5e86aff2d3c4fad9c56f3df263d9f7b27de8ffa3cd508537a300
SSDEEP

12288:mQJRsrrQqYvbeUVOyJ3GJNu0ADIJTls9tJBKM1I59rM:akkyJoNYDOsrqM259A

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2148 1884 WerFault.exe 132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf.exe

pid	pid_target	process	target process
2148	1884	WerFault.exe	132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf.exe

description	pid	process	target process
PID 1884 wrote to memory of 2148	1884	132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf.exe	WerFault.exe
PID 1884 wrote to memory of 2148	1884	132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf.exe	WerFault.exe
PID 1884 wrote to memory of 2148	1884	132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf.exe	WerFault.exe
PID 1884 wrote to memory of 2148	1884	132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf.exe
"C:\Users\Admin\AppData\Local\Temp\132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 48
  2⤵
  - Program crash
  PID:2148

memory/1884-0-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/1884-1-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download