496219a22d96d4eb4c699045521b7fa73bba242d4e84e62f565e8d8046fa00c5

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 22:53

Target

496219a22d96d4eb4c699045521b7fa73bba242d4e84e62f565e8d8046fa00c5.exe
Size

1.0MB
MD5

585d16749fda38cb7f8a987137890167
SHA1

0b3f1064b2f0ddf397552e442e99e1c233c67df1
SHA256

496219a22d96d4eb4c699045521b7fa73bba242d4e84e62f565e8d8046fa00c5
SHA512

784c3a2e3fa3e90f57ed059a5bc204441da3ebc173a93b67e752f84cc2e2cf0f4ddc49aabeaa3233053e49d51633f6bb93a90c0735292084305b00bf79b2c632
SSDEEP

24576:23xZfO09c1MhIix2MZimC8GRPrvbyK5glhZ:23xhc1AIix2MUhRjvbyUe

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2936	2880	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

496219a22d96d4eb4c699045521b7fa73bba242d4e84e62f565e8d8046fa00c5.exe

description	pid	Process	procid_target
PID 2880 wrote to memory of 2936	2880	496219a22d96d4eb4c699045521b7fa73bba242d4e84e62f565e8d8046fa00c5.exe	28
PID 2880 wrote to memory of 2936	2880	496219a22d96d4eb4c699045521b7fa73bba242d4e84e62f565e8d8046fa00c5.exe	28
PID 2880 wrote to memory of 2936	2880	496219a22d96d4eb4c699045521b7fa73bba242d4e84e62f565e8d8046fa00c5.exe	28
PID 2880 wrote to memory of 2936	2880	496219a22d96d4eb4c699045521b7fa73bba242d4e84e62f565e8d8046fa00c5.exe	28

C:\Users\Admin\AppData\Local\Temp\496219a22d96d4eb4c699045521b7fa73bba242d4e84e62f565e8d8046fa00c5.exe
"C:\Users\Admin\AppData\Local\Temp\496219a22d96d4eb4c699045521b7fa73bba242d4e84e62f565e8d8046fa00c5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 72
  2⤵
  - Program crash
  PID:2936

memory/2880-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2880-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download