2406ce734983617993a204275a82b223994da888faff57858b399b6b138c5eea

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 22:19

Target

3018c312c16fe4ef9a84586cde5a8190N.exe
Size

641KB
MD5

3018c312c16fe4ef9a84586cde5a8190
SHA1

5bccd9943cd46945f7f405d6dcf0dd7f3db07258
SHA256

2406ce734983617993a204275a82b223994da888faff57858b399b6b138c5eea
SHA512

d673f0f4d42c6b6548b5e238793865a15a8a4be3267c5c01c858569b6024819a9b2927b3778ffde00501d6b8e77d2fa72585daaa83477e6579ef29c74975d3a4
SSDEEP

12288:Z11JbfUSnIJKfJrvpC5raJqoiWcVG89gwX860eUW128n6bWki:n1JbL6yL2rKiWcVGS8heB1286Cki

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2056	2628	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2056	2628	3018c312c16fe4ef9a84586cde5a8190N.exe	31
PID 2628 wrote to memory of 2056	2628	3018c312c16fe4ef9a84586cde5a8190N.exe	31
PID 2628 wrote to memory of 2056	2628	3018c312c16fe4ef9a84586cde5a8190N.exe	31
PID 2628 wrote to memory of 2056	2628	3018c312c16fe4ef9a84586cde5a8190N.exe	31

C:\Users\Admin\AppData\Local\Temp\3018c312c16fe4ef9a84586cde5a8190N.exe
"C:\Users\Admin\AppData\Local\Temp\3018c312c16fe4ef9a84586cde5a8190N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 664
  2⤵
  - Program crash
  PID:2056

memory/2628-0-0x0000000074DBE000-0x0000000074DBF000-memory.dmp

Filesize
4KB

Download
memory/2628-1-0x0000000000020000-0x00000000000C6000-memory.dmp

Filesize
664KB

Download
memory/2628-2-0x0000000074DB0000-0x000000007549E000-memory.dmp

Filesize
6.9MB

Download
memory/2628-3-0x0000000074DB0000-0x000000007549E000-memory.dmp

Filesize
6.9MB

Download