d716067dbc280962523615988e83b1013bafd4c3a2352d57d67231809bef0e72

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 02:34

Target

e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe
Size

597KB
MD5

1a2a26995d43c4ad2f2c9e9e9373d5c8
SHA1

bc9592e1846b06b6e770d443c3802a887fb92987
SHA256

e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c
SHA512

b7138aaef1d2e98c898983fdc5e2255f965e6c1a03fd8b01fe22197f23f61c8e237ce15b582f50d28e64e312a6f565c0d8a13efeeb83a898bd2f2b75165d9743
SSDEEP

12288:y58K1Ff7F68gwFVUHWtOhYQ6YtQRkl904F2VHCU8MAwWoTVLiPgsFEO:y51bCYUHR/j0kzUVHCBwhTkt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2388	2820	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2388	2820	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe	28
PID 2820 wrote to memory of 2388	2820	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe	28
PID 2820 wrote to memory of 2388	2820	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe	28
PID 2820 wrote to memory of 2388	2820	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe	28

C:\Users\Admin\AppData\Local\Temp\e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe
"C:\Users\Admin\AppData\Local\Temp\e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 108
  2⤵
  - Program crash
  PID:2388

memory/2820-0-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download