2278f5c657b036e07e47e821dede5357c16bb720f66bcb5d8685319db960202e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 20:28

Target

2278f5c657b036e07e47e821dede5357c16bb720f66bcb5d8685319db960202e.exe
Size

3.7MB
MD5

ed138594792289b6f68c55a398597af8
SHA1

36353ffb437db153df37ef3ff5134e3db9733056
SHA256

2278f5c657b036e07e47e821dede5357c16bb720f66bcb5d8685319db960202e
SHA512

ea305c31cd9e038c60a02b478246ce742d5e9949ae0bf91c62a45e7f5d29dabb9a2f1065376419171818bff3d8699b54063eb009fc719c2930ae368a50a57710
SSDEEP

49152:95MWiEY3dE3NR1Jot9rSzFeetLsQw2QSzKzQUshVUDEMiFnuxQobLEf:XYgNNojSzQep7w25G8UW5xFnCQff

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2672 348 WerFault.exe 2278f5c657b036e07e47e821dede5357c16bb720f66bcb5d8685319db960202e.exe

pid	pid_target	process	target process
2672	348	WerFault.exe	2278f5c657b036e07e47e821dede5357c16bb720f66bcb5d8685319db960202e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2278f5c657b036e07e47e821dede5357c16bb720f66bcb5d8685319db960202e.exe

description	pid	process	target process
PID 348 wrote to memory of 2672	348	2278f5c657b036e07e47e821dede5357c16bb720f66bcb5d8685319db960202e.exe	WerFault.exe
PID 348 wrote to memory of 2672	348	2278f5c657b036e07e47e821dede5357c16bb720f66bcb5d8685319db960202e.exe	WerFault.exe
PID 348 wrote to memory of 2672	348	2278f5c657b036e07e47e821dede5357c16bb720f66bcb5d8685319db960202e.exe	WerFault.exe
PID 348 wrote to memory of 2672	348	2278f5c657b036e07e47e821dede5357c16bb720f66bcb5d8685319db960202e.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2278f5c657b036e07e47e821dede5357c16bb720f66bcb5d8685319db960202e.exe
"C:\Users\Admin\AppData\Local\Temp\2278f5c657b036e07e47e821dede5357c16bb720f66bcb5d8685319db960202e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 700
2⤵
- Program crash
PID:2672

memory/348-0-0x0000000074A8E000-0x0000000074A8F000-memory.dmp

Filesize
4KB

Download
memory/348-1-0x00000000012C0000-0x0000000001680000-memory.dmp

Filesize
3.8MB

Download
memory/348-2-0x0000000074A80000-0x000000007516E000-memory.dmp

Filesize
6.9MB

Download
memory/348-3-0x0000000074A80000-0x000000007516E000-memory.dmp

Filesize
6.9MB

Download