88cd5d133331860140170c3ee6a646469c7e28b789903c9c225833827204d2dc

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 19:26

Target

2576-69-0x0000000000400000-0x0000000000646000-memory.exe
Size

2.3MB
MD5

c6d2aa413a76c75d1f04b372cf005bde
SHA1

b34a7ea6cec96b4376f9380e78284ea4a5baba77
SHA256

88cd5d133331860140170c3ee6a646469c7e28b789903c9c225833827204d2dc
SHA512

6ade9ad452e3f7e3bb3daed60321b7a79ed339ee92ec04c396d25f85b5c778427cf89213d65b2d5936d712fa3eaa0d6b4fe11918fd0e859a2a32b9b08a2cdda1
SSDEEP

3072:5f8nGHElvZZT+4qXcHvuefUbgtvfYtgJS+rjCBU:58nFlvCxBX2XYKSUjU

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2864 2184 WerFault.exe 2576-69-0x0000000000400000-0x0000000000646000-memory.exe

pid	pid_target	process	target process
2864	2184	WerFault.exe	2576-69-0x0000000000400000-0x0000000000646000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2576-69-0x0000000000400000-0x0000000000646000-memory.exe

description	pid	process	target process
PID 2184 wrote to memory of 2864	2184	2576-69-0x0000000000400000-0x0000000000646000-memory.exe	WerFault.exe
PID 2184 wrote to memory of 2864	2184	2576-69-0x0000000000400000-0x0000000000646000-memory.exe	WerFault.exe
PID 2184 wrote to memory of 2864	2184	2576-69-0x0000000000400000-0x0000000000646000-memory.exe	WerFault.exe
PID 2184 wrote to memory of 2864	2184	2576-69-0x0000000000400000-0x0000000000646000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2576-69-0x0000000000400000-0x0000000000646000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2576-69-0x0000000000400000-0x0000000000646000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 36
2⤵
- Program crash
PID:2864