36a33e7da8ad27ce449d6bc53c6ca650bc283b8f96d5fe797187aea40e0dcc68

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 09:13

Target

236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe
Size

694KB
MD5

c8032b42738527a70de1dadc4a7bff5b
SHA1

f5f778df15d4e14503bea0f654cf9427ba050a38
SHA256

236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5
SHA512

babddfaac51c11952a79047852b01c499075acfe24e91dac46a5c590a31be1e4e71df5b1daf27254d9d608fa7345839790f8a550e04392de7f625c5d6b22a97d
SSDEEP

12288:OO0Jg3ZJ7hWFArUqHsjumNFcF9gopM3bcgsqV5P3JkTC:OJJU7hWFuHyumzcCLUqV5v0

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2164 1368 WerFault.exe 236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe

pid	pid_target	process	target process
2164	1368	WerFault.exe	236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe

description	pid	process	target process
PID 1368 wrote to memory of 2164	1368	236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe	WerFault.exe
PID 1368 wrote to memory of 2164	1368	236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe	WerFault.exe
PID 1368 wrote to memory of 2164	1368	236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe	WerFault.exe
PID 1368 wrote to memory of 2164	1368	236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe
"C:\Users\Admin\AppData\Local\Temp\236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 128
2⤵
- Program crash
PID:2164

memory/1368-0-0x00000000000E0000-0x000000000012D000-memory.dmp

Filesize
308KB

Download
memory/1368-5-0x0000000000180000-0x0000000000232000-memory.dmp

Filesize
712KB

Download