21e4edba93a7034e8c50caa70d1d3973e506b177adef0d42e1a6a823ca909637

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 03:40

Target

11bff9eb960203dd7142e9673fe524c7e1e4d4982a80ea2000b59cd4ee335ee8.exe
Size

514KB
MD5

a36a43dbdd27f849d020764ec3033eb7
SHA1

ece2cedba8220bd7ca753e5a067c1eb2209e2ff4
SHA256

11bff9eb960203dd7142e9673fe524c7e1e4d4982a80ea2000b59cd4ee335ee8
SHA512

2abfd91a238395e7bdd5355d2fc9880cc10fa82b9ef792ff2b31dfeff2d0430c09eb3deab9d2f721109456071513d9f38c659d0fadfef1331ed0400668f9ef5d
SSDEEP

12288:AZH6svPR/nJLDNA2v0NYqq34pFfRpwpoTtXiq/:LsvBJLDBvHqDHbtyq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2032	2232	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2032	2232	11bff9eb960203dd7142e9673fe524c7e1e4d4982a80ea2000b59cd4ee335ee8.exe	29
PID 2232 wrote to memory of 2032	2232	11bff9eb960203dd7142e9673fe524c7e1e4d4982a80ea2000b59cd4ee335ee8.exe	29
PID 2232 wrote to memory of 2032	2232	11bff9eb960203dd7142e9673fe524c7e1e4d4982a80ea2000b59cd4ee335ee8.exe	29
PID 2232 wrote to memory of 2032	2232	11bff9eb960203dd7142e9673fe524c7e1e4d4982a80ea2000b59cd4ee335ee8.exe	29

C:\Users\Admin\AppData\Local\Temp\11bff9eb960203dd7142e9673fe524c7e1e4d4982a80ea2000b59cd4ee335ee8.exe
"C:\Users\Admin\AppData\Local\Temp\11bff9eb960203dd7142e9673fe524c7e1e4d4982a80ea2000b59cd4ee335ee8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 96
  2⤵
  - Program crash
  PID:2032

memory/2232-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download