3719553e1508355188dc438778146c0e43fa44227e71ecfbb75852ae17f064ae

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 21:40

Target

3719553e1508355188dc438778146c0e43fa44227e71ecfbb75852ae17f064ae.exe
Size

4KB
MD5

7f7f5e54963968e53af82bab88d9346a
SHA1

733f82917dfad6a49af526849f59d270c94d7a21
SHA256

3719553e1508355188dc438778146c0e43fa44227e71ecfbb75852ae17f064ae
SHA512

6c9c167298e65b17bab80a981ae69a327d9256bacbab091069cce3441734b370a970f3a24a4a3001fd1d0efbd1d0518b8d4060ad63ef3d902223d435654433e2
SSDEEP

48:6opFKSTHmEWoEFQbNMLnMwl7N1qdCt+8lH4lImQFypfbNtm:SYHmEWDFnRWiGVzNt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2328	2084	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2328	2084	3719553e1508355188dc438778146c0e43fa44227e71ecfbb75852ae17f064ae.exe	29
PID 2084 wrote to memory of 2328	2084	3719553e1508355188dc438778146c0e43fa44227e71ecfbb75852ae17f064ae.exe	29
PID 2084 wrote to memory of 2328	2084	3719553e1508355188dc438778146c0e43fa44227e71ecfbb75852ae17f064ae.exe	29
PID 2084 wrote to memory of 2328	2084	3719553e1508355188dc438778146c0e43fa44227e71ecfbb75852ae17f064ae.exe	29

C:\Users\Admin\AppData\Local\Temp\3719553e1508355188dc438778146c0e43fa44227e71ecfbb75852ae17f064ae.exe
"C:\Users\Admin\AppData\Local\Temp\3719553e1508355188dc438778146c0e43fa44227e71ecfbb75852ae17f064ae.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 528
  2⤵
  - Program crash
  PID:2328

memory/2084-1-0x0000000000EE0000-0x0000000000EE8000-memory.dmp

Filesize
32KB

Download
memory/2084-0-0x00000000745DE000-0x00000000745DF000-memory.dmp

Filesize
4KB

Download