1131502a0ddd7c7c36b072b4905d9e8c9aed8df2903121f6cbb4845d3c184805

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
26/06/2024, 01:43

Target

1131502a0ddd7c7c36b072b4905d9e8c9aed8df2903121f6cbb4845d3c184805.exe
Size

1.3MB
MD5

23b4ac5acd7cdba9e96be61604bb0b37
SHA1

1bb2ef40ed00ea5dd16f39d796925b0d81b26332
SHA256

1131502a0ddd7c7c36b072b4905d9e8c9aed8df2903121f6cbb4845d3c184805
SHA512

33c76938c6f65e6d46561bcfdfce28ce1a0b870ba14aaf5835226fb9d4f4a56afe2dfd49c5f932b5ecca2651a5acda0317969b17f31aaf1af457fe104392bbf0
SSDEEP

24576:vkQQFlYqDf5meBEl3ctPAcDCRv843/6XrcRtauf:eRDf5meW1gk04P6bc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2612	2960	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2612	2960	1131502a0ddd7c7c36b072b4905d9e8c9aed8df2903121f6cbb4845d3c184805.exe	28
PID 2960 wrote to memory of 2612	2960	1131502a0ddd7c7c36b072b4905d9e8c9aed8df2903121f6cbb4845d3c184805.exe	28
PID 2960 wrote to memory of 2612	2960	1131502a0ddd7c7c36b072b4905d9e8c9aed8df2903121f6cbb4845d3c184805.exe	28
PID 2960 wrote to memory of 2612	2960	1131502a0ddd7c7c36b072b4905d9e8c9aed8df2903121f6cbb4845d3c184805.exe	28

C:\Users\Admin\AppData\Local\Temp\1131502a0ddd7c7c36b072b4905d9e8c9aed8df2903121f6cbb4845d3c184805.exe
"C:\Users\Admin\AppData\Local\Temp\1131502a0ddd7c7c36b072b4905d9e8c9aed8df2903121f6cbb4845d3c184805.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 668
  2⤵
  - Program crash
  PID:2612

memory/2960-0-0x0000000073F5E000-0x0000000073F5F000-memory.dmp

Filesize
4KB

Download
memory/2960-1-0x0000000000080000-0x00000000001D0000-memory.dmp

Filesize
1.3MB

Download
memory/2960-2-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download
memory/2960-3-0x0000000004FD0000-0x000000000506A000-memory.dmp

Filesize
616KB

Download
memory/2960-4-0x0000000001E80000-0x0000000001E90000-memory.dmp

Filesize
64KB

Download
memory/2960-5-0x0000000001EA0000-0x0000000001EAC000-memory.dmp

Filesize
48KB

Download
memory/2960-6-0x0000000073F5E000-0x0000000073F5F000-memory.dmp

Filesize
4KB

Download
memory/2960-7-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download