9914c054ad215f2b6b43e9e1893fc3cc7fe72b9dedb8c1582fbb188f78354076

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 17:54

Target

2460-69-0x0000000000400000-0x0000000000648000-memory.exe
Size

2.3MB
MD5

d094baa2ac4dc40232ad0cda9d646759
SHA1

977db28f21b149ec1c40a78b356f59f9e81ace43
SHA256

9914c054ad215f2b6b43e9e1893fc3cc7fe72b9dedb8c1582fbb188f78354076
SHA512

4f07b32e4ab081a0c45d69043cecab5ea98a836c514b717c9478178d7469aecbf7581f365d4f256e5943ede4a4964a082e0e67251fc13eaf7609767a2dab33e5
SSDEEP

3072:s6g3bwNMJgdJ11Em1JVa0x7+0NVmiHoM8fmNb0PXMTZ4:lg3bgMJGfDaa7z9/8CkXkZ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2076 2564 WerFault.exe 2460-69-0x0000000000400000-0x0000000000648000-memory.exe

pid	pid_target	process	target process
2076	2564	WerFault.exe	2460-69-0x0000000000400000-0x0000000000648000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2460-69-0x0000000000400000-0x0000000000648000-memory.exe

description	pid	process	target process
PID 2564 wrote to memory of 2076	2564	2460-69-0x0000000000400000-0x0000000000648000-memory.exe	WerFault.exe
PID 2564 wrote to memory of 2076	2564	2460-69-0x0000000000400000-0x0000000000648000-memory.exe	WerFault.exe
PID 2564 wrote to memory of 2076	2564	2460-69-0x0000000000400000-0x0000000000648000-memory.exe	WerFault.exe
PID 2564 wrote to memory of 2076	2564	2460-69-0x0000000000400000-0x0000000000648000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2460-69-0x0000000000400000-0x0000000000648000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2460-69-0x0000000000400000-0x0000000000648000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 36
2⤵
- Program crash
PID:2076