4740431c3bca0ea1f96d572d4bec31e8365270a2eaf7f20201b5b85a145e47db

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 09:12

Target

4740431c3bca0ea1f96d572d4bec31e8365270a2eaf7f20201b5b85a145e47db.exe
Size

4.9MB
MD5

85bd70446bbddf797e1625736086fc1e
SHA1

5e87268e0f1112626f9c0097a304f688b574a688
SHA256

4740431c3bca0ea1f96d572d4bec31e8365270a2eaf7f20201b5b85a145e47db
SHA512

9ab83aa42b0c0943640fb350c94d755c78dbff93d19aa4b7e64930a23cdf991464a56f3b2d1cc5b71fa1572fe82c00076f4eee1039418985a6efca9f10ad9879
SSDEEP

98304:gCFD2jElPqLk5Gf9CsWZyhgg2SWkZ0mKkGUkw8B+vSzwLiSb0uFiULL5:gCtdWkEf9hWZyhl2QWQ3vSzwLiYpLL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2728	2088	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2728	2088	4740431c3bca0ea1f96d572d4bec31e8365270a2eaf7f20201b5b85a145e47db.exe	28
PID 2088 wrote to memory of 2728	2088	4740431c3bca0ea1f96d572d4bec31e8365270a2eaf7f20201b5b85a145e47db.exe	28
PID 2088 wrote to memory of 2728	2088	4740431c3bca0ea1f96d572d4bec31e8365270a2eaf7f20201b5b85a145e47db.exe	28
PID 2088 wrote to memory of 2728	2088	4740431c3bca0ea1f96d572d4bec31e8365270a2eaf7f20201b5b85a145e47db.exe	28

C:\Users\Admin\AppData\Local\Temp\4740431c3bca0ea1f96d572d4bec31e8365270a2eaf7f20201b5b85a145e47db.exe
"C:\Users\Admin\AppData\Local\Temp\4740431c3bca0ea1f96d572d4bec31e8365270a2eaf7f20201b5b85a145e47db.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 780
  2⤵
  - Program crash
  PID:2728

memory/2088-0-0x000000007406E000-0x000000007406F000-memory.dmp

Filesize
4KB

Download
memory/2088-1-0x0000000000940000-0x0000000000E36000-memory.dmp

Filesize
5.0MB

Download
memory/2088-2-0x00000000082D0000-0x0000000008734000-memory.dmp

Filesize
4.4MB

Download
memory/2088-3-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/2088-4-0x0000000004BF0000-0x0000000004CB4000-memory.dmp

Filesize
784KB

Download
memory/2088-5-0x0000000006A80000-0x0000000006F5E000-memory.dmp

Filesize
4.9MB

Download
memory/2088-6-0x0000000000410000-0x0000000000448000-memory.dmp

Filesize
224KB

Download
memory/2088-7-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/2088-8-0x00000000022A0000-0x00000000022CA000-memory.dmp

Filesize
168KB

Download
memory/2088-9-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/2088-10-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/2088-11-0x0000000002340000-0x0000000002376000-memory.dmp

Filesize
216KB

Download
memory/2088-12-0x0000000000930000-0x0000000000936000-memory.dmp

Filesize
24KB

Download
memory/2088-13-0x000000007406E000-0x000000007406F000-memory.dmp

Filesize
4KB

Download
memory/2088-14-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download