17602e219f7ab79b6d6b5eb1d1f50c288f32d0eeced20e82ce639de08c32d8e7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 04:02

Target

672f24842aeb72d7bd8d64e78aaba5f3a953409ce21cfe97d3a80e7ef67f232a.exe
Size

1.7MB
MD5

e8a7d0c6dedce0d4a403908a29273d43
SHA1

8289c35dabaee32f61c74de6a4e8308dc98eb075
SHA256

672f24842aeb72d7bd8d64e78aaba5f3a953409ce21cfe97d3a80e7ef67f232a
SHA512

c8bf2f42f7bcf6f6b752ba5165c57ee99d4b31d5ba48ce1c2651afdb8bc37a14f392253f3daa0e811116d11d4c9175dc55cfb1baac0c30a71a18e1df17e73770
SSDEEP

24576:uVKlwZW7rdhSklldluAi8XBBv3b1bNtFPEh8OyPe+ZkGRACQX48n9pJSQ2KxLqYV:LlwZEDSWercBvB7xEdr2dRqucwcr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2800	2488	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2800	2488	672f24842aeb72d7bd8d64e78aaba5f3a953409ce21cfe97d3a80e7ef67f232a.exe	28
PID 2488 wrote to memory of 2800	2488	672f24842aeb72d7bd8d64e78aaba5f3a953409ce21cfe97d3a80e7ef67f232a.exe	28
PID 2488 wrote to memory of 2800	2488	672f24842aeb72d7bd8d64e78aaba5f3a953409ce21cfe97d3a80e7ef67f232a.exe	28
PID 2488 wrote to memory of 2800	2488	672f24842aeb72d7bd8d64e78aaba5f3a953409ce21cfe97d3a80e7ef67f232a.exe	28

C:\Users\Admin\AppData\Local\Temp\672f24842aeb72d7bd8d64e78aaba5f3a953409ce21cfe97d3a80e7ef67f232a.exe
"C:\Users\Admin\AppData\Local\Temp\672f24842aeb72d7bd8d64e78aaba5f3a953409ce21cfe97d3a80e7ef67f232a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 52
  2⤵
  - Program crash
  PID:2800

memory/2488-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2488-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download