ab909eb6a3fa08bf2ce1957ba1cd0cd9c0743c9f0e3ae9a237fbd033b3b6f81f

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08-06-2024 04:05

Target

3c60508e4f72670823c939c99ad928a9d585f4bae8c5022452a7e0705335535c.exe
Size

751KB
MD5

c50d7dcb55c5e666a0b4a0006d6cb80d
SHA1

8a53d8cd9e0e2c1fd55c62c95d140b7669f7ccd5
SHA256

3c60508e4f72670823c939c99ad928a9d585f4bae8c5022452a7e0705335535c
SHA512

3c177c36a943a8f25a24b28e47723ead74fb7d77eadeab66982fa3e98c7eff32ae8b01b0828af73c8153d4658adeb60d219bf41e32b86fcd6631452f99f6b46c
SSDEEP

12288:2xaeop3n/uaugXz+UhAWwG8IMfL57tnvSN6JuTZpNKnd3D+YQaaoA0fJxO5nwS9o:QJUnpugb8IO5ZSkJYbNK+PahpzO5wQhC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2364	2424	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2364	2424	3c60508e4f72670823c939c99ad928a9d585f4bae8c5022452a7e0705335535c.exe	28
PID 2424 wrote to memory of 2364	2424	3c60508e4f72670823c939c99ad928a9d585f4bae8c5022452a7e0705335535c.exe	28
PID 2424 wrote to memory of 2364	2424	3c60508e4f72670823c939c99ad928a9d585f4bae8c5022452a7e0705335535c.exe	28
PID 2424 wrote to memory of 2364	2424	3c60508e4f72670823c939c99ad928a9d585f4bae8c5022452a7e0705335535c.exe	28

C:\Users\Admin\AppData\Local\Temp\3c60508e4f72670823c939c99ad928a9d585f4bae8c5022452a7e0705335535c.exe
"C:\Users\Admin\AppData\Local\Temp\3c60508e4f72670823c939c99ad928a9d585f4bae8c5022452a7e0705335535c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 548
  2⤵
  - Program crash
  PID:2364

memory/2424-0-0x0000000073FEE000-0x0000000073FEF000-memory.dmp

Filesize
4KB

Download
memory/2424-1-0x0000000000170000-0x0000000000230000-memory.dmp

Filesize
768KB

Download
memory/2424-2-0x0000000073FEE000-0x0000000073FEF000-memory.dmp

Filesize
4KB

Download