02616c8612728f9617c1a17b2cfb5fe44271c63a397f7e8ea6ba211fcd35fba7

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 16:22

Target

3560-0-0x0000000000400000-0x000000000062E000-memory.exe
Size

2.2MB
MD5

f881c32a06fb973cfacf4ba940e220cb
SHA1

cc3f70a8bebd448f1176e9cabe80d21bb0935c11
SHA256

02616c8612728f9617c1a17b2cfb5fe44271c63a397f7e8ea6ba211fcd35fba7
SHA512

772a2345b7fb2dddb912e644a62b65c0475795c9341bdb1d7421360e92137e657bd02582c4edba0952686542c55c5ee9e698f6a067d9d541b7a2ac264a481c04
SSDEEP

1536:SHg47qWPlw/yzQO6PQB6oy5wIay/AOSxGPN0n6p/r2j8YDqavs46msTvmiOWRDZH:sg471w/yH6ooxFp/5Pr45eROQh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2456	1688	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2456	1688	3560-0-0x0000000000400000-0x000000000062E000-memory.exe	28
PID 1688 wrote to memory of 2456	1688	3560-0-0x0000000000400000-0x000000000062E000-memory.exe	28
PID 1688 wrote to memory of 2456	1688	3560-0-0x0000000000400000-0x000000000062E000-memory.exe	28
PID 1688 wrote to memory of 2456	1688	3560-0-0x0000000000400000-0x000000000062E000-memory.exe	28

C:\Users\Admin\AppData\Local\Temp\3560-0-0x0000000000400000-0x000000000062E000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\3560-0-0x0000000000400000-0x000000000062E000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 36
  2⤵
  - Program crash
  PID:2456

memory/1688-0-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download