57809cbc4f5ab49a341fa7817e45de3a6f7c481d469fc45bd39cc1c0568a7ddd

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 07:31

Target

2512-3-0x0000000000400000-0x0000000000415000-memory.exe
Size

84KB
MD5

4b38e32b37a3bf0f2a62755648aacb27
SHA1

72d2e541bc57ca43919d0db33122e2b6385c1b1a
SHA256

57809cbc4f5ab49a341fa7817e45de3a6f7c481d469fc45bd39cc1c0568a7ddd
SHA512

578109ea7c46e191dc0bdbc2318f0b630be1e31c78968b79180893f2f10bb93bab6e69850b5b6a2ea855417432827dd0d95115770b06869d6aac6fa0c632074b
SSDEEP

1536:6kes21VCy1nTxSYg3CXTjFWL9xdpIIFUc:6DVCyFxSYACXFUpII6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2124 1700 WerFault.exe 2512-3-0x0000000000400000-0x0000000000415000-memory.exe

pid	pid_target	process	target process
2124	1700	WerFault.exe	2512-3-0x0000000000400000-0x0000000000415000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2512-3-0x0000000000400000-0x0000000000415000-memory.exe

description	pid	process	target process
PID 1700 wrote to memory of 2124	1700	2512-3-0x0000000000400000-0x0000000000415000-memory.exe	WerFault.exe
PID 1700 wrote to memory of 2124	1700	2512-3-0x0000000000400000-0x0000000000415000-memory.exe	WerFault.exe
PID 1700 wrote to memory of 2124	1700	2512-3-0x0000000000400000-0x0000000000415000-memory.exe	WerFault.exe
PID 1700 wrote to memory of 2124	1700	2512-3-0x0000000000400000-0x0000000000415000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2512-3-0x0000000000400000-0x0000000000415000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2512-3-0x0000000000400000-0x0000000000415000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 36
2⤵
- Program crash
PID:2124