39475882127fd9789d9c23444153a4a4841f3ffbb34ffabb0c540e6e9d76d034

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 11:41

Target

39475882127fd9789d9c23444153a4a4841f3ffbb34ffabb0c540e6e9d76d034.exe
Size

1.3MB
MD5

913c99449a29c2640d36b0d5fdf69289
SHA1

858971f52ab45dc8be5f2c43da9b0c25ba398435
SHA256

39475882127fd9789d9c23444153a4a4841f3ffbb34ffabb0c540e6e9d76d034
SHA512

b35a9a28d01a948455da4d078d9f9d1aacb5e9fff5c8359b4278400e29296c75ff96554ae6cc8cd4f53d1db8525d43927c87b793e3fb2e72549d944fd62a6d96
SSDEEP

24576:AP+g7Wy3xfMZKdcKtTjbJ4HEEEEEEEEEEEEEEEEEEEETKKKKKKKKKKKKKKKKKKK7:A/iy3g6TjbsEEEEEEEEEEEEEEEEEEEE+

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2576 2072 WerFault.exe 39475882127fd9789d9c23444153a4a4841f3ffbb34ffabb0c540e6e9d76d034.exe

pid	pid_target	process	target process
2576	2072	WerFault.exe	39475882127fd9789d9c23444153a4a4841f3ffbb34ffabb0c540e6e9d76d034.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

39475882127fd9789d9c23444153a4a4841f3ffbb34ffabb0c540e6e9d76d034.exe

description	pid	process	target process
PID 2072 wrote to memory of 2576	2072	39475882127fd9789d9c23444153a4a4841f3ffbb34ffabb0c540e6e9d76d034.exe	WerFault.exe
PID 2072 wrote to memory of 2576	2072	39475882127fd9789d9c23444153a4a4841f3ffbb34ffabb0c540e6e9d76d034.exe	WerFault.exe
PID 2072 wrote to memory of 2576	2072	39475882127fd9789d9c23444153a4a4841f3ffbb34ffabb0c540e6e9d76d034.exe	WerFault.exe
PID 2072 wrote to memory of 2576	2072	39475882127fd9789d9c23444153a4a4841f3ffbb34ffabb0c540e6e9d76d034.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\39475882127fd9789d9c23444153a4a4841f3ffbb34ffabb0c540e6e9d76d034.exe
"C:\Users\Admin\AppData\Local\Temp\39475882127fd9789d9c23444153a4a4841f3ffbb34ffabb0c540e6e9d76d034.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 676
2⤵
- Program crash
PID:2576

memory/2072-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2072-1-0x0000000000400000-0x000000000055C000-memory.dmp

Filesize
1.4MB

Download