17f20cbf348c13770191539ebadd373d2bb44905299e8d656eba5608f97665a5

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 23:17

Target

43853893c38f118bb52abf0102e668673c95a41927665b7683636f13c451dd21_dump.exe
Size

2.6MB
MD5

7070bdc7171652e61483e705c17984cc
SHA1

5ca9d044fe25d70de23afaba2e2704065bfc01cb
SHA256

17f20cbf348c13770191539ebadd373d2bb44905299e8d656eba5608f97665a5
SHA512

c7e1b8ee8c91a27ff70cfcde5a2cf4f7edecf3af9f7ec57382313eb92282a4edb872d3083f4a1b9203329da545173f5541085bc2db1290e879484848045c867d
SSDEEP

49152:kyRW+pczknonGwiM5Eek1ZovRWE5ek1ZovRWEgyRW+pcNq0elxI3Pq0elxI3:H4+pcIc5iAwgRN7gRNr4+pc4xlNxl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1580	568	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
568	43853893c38f118bb52abf0102e668673c95a41927665b7683636f13c451dd21_dump.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 1580	568	43853893c38f118bb52abf0102e668673c95a41927665b7683636f13c451dd21_dump.exe	28
PID 568 wrote to memory of 1580	568	43853893c38f118bb52abf0102e668673c95a41927665b7683636f13c451dd21_dump.exe	28
PID 568 wrote to memory of 1580	568	43853893c38f118bb52abf0102e668673c95a41927665b7683636f13c451dd21_dump.exe	28
PID 568 wrote to memory of 1580	568	43853893c38f118bb52abf0102e668673c95a41927665b7683636f13c451dd21_dump.exe	28

C:\Users\Admin\AppData\Local\Temp\43853893c38f118bb52abf0102e668673c95a41927665b7683636f13c451dd21_dump.exe
"C:\Users\Admin\AppData\Local\Temp\43853893c38f118bb52abf0102e668673c95a41927665b7683636f13c451dd21_dump.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 568 -s 36
  2⤵
  - Program crash
  PID:1580

memory/568-0-0x0000000000341000-0x0000000000344000-memory.dmp

Filesize
12KB

Download
memory/568-1-0x0000000000340000-0x0000000000382000-memory.dmp

Filesize
264KB

Download
memory/568-2-0x0000000000340000-0x0000000000382000-memory.dmp

Filesize
264KB

Download
memory/568-3-0x0000000000341000-0x0000000000344000-memory.dmp

Filesize
12KB

Download
memory/568-4-0x0000000000340000-0x0000000000382000-memory.dmp

Filesize
264KB

Download