fad264acc346be1e63cd47611cd305cb9c894a13843119e22e87744808295387

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 05:10

Target

fad264acc346be1e63cd47611cd305cb9c894a13843119e22e87744808295387.exe
Size

420KB
MD5

f88272ea7674d3acedd8adcf7643c598
SHA1

0066fd44e2cd9293af414f735bd80456f4e3eb1d
SHA256

fad264acc346be1e63cd47611cd305cb9c894a13843119e22e87744808295387
SHA512

3d3435572767b85307271519a5a51668e284cc9aa0d09bf024aaff31a4b4329bb189c627ceda90ba00f02445f0d34f4de642b30b054ecf9d1ac88babeb113963
SSDEEP

12288:Zh0vCnLVT7zishmwaOF9dJl3AnhpzTly:Z8kLVPzMO9dnQnhZT

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1924 1932 WerFault.exe fad264acc346be1e63cd47611cd305cb9c894a13843119e22e87744808295387.exe

pid	pid_target	process	target process
1924	1932	WerFault.exe	fad264acc346be1e63cd47611cd305cb9c894a13843119e22e87744808295387.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fad264acc346be1e63cd47611cd305cb9c894a13843119e22e87744808295387.exe

description	pid	process	target process
PID 1932 wrote to memory of 1924	1932	fad264acc346be1e63cd47611cd305cb9c894a13843119e22e87744808295387.exe	WerFault.exe
PID 1932 wrote to memory of 1924	1932	fad264acc346be1e63cd47611cd305cb9c894a13843119e22e87744808295387.exe	WerFault.exe
PID 1932 wrote to memory of 1924	1932	fad264acc346be1e63cd47611cd305cb9c894a13843119e22e87744808295387.exe	WerFault.exe
PID 1932 wrote to memory of 1924	1932	fad264acc346be1e63cd47611cd305cb9c894a13843119e22e87744808295387.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fad264acc346be1e63cd47611cd305cb9c894a13843119e22e87744808295387.exe
"C:\Users\Admin\AppData\Local\Temp\fad264acc346be1e63cd47611cd305cb9c894a13843119e22e87744808295387.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 96
2⤵
- Program crash
PID:1924

memory/1932-0-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download