7679ebcd5161dcaa77c8a13cbb507ff7fc1568b1f571fdd9a61643dbe8f1ecaf

Analysis

max time kernel
153s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 04:58

Target

7679ebcd5161dcaa77c8a13cbb507ff7fc1568b1f571fdd9a61643dbe8f1ecaf.exe
Size

3.4MB
MD5

6fdcb9087ea977bc305e470736b75b07
SHA1

daa06eddba68a942998f7af0fee6e554761adc95
SHA256

7679ebcd5161dcaa77c8a13cbb507ff7fc1568b1f571fdd9a61643dbe8f1ecaf
SHA512

40a86a792252ec34cd0498d3b9e54177a0f9000e05494d5e73bbe19ef8e3a321cc5b083cff5065cfbf57cb0c5e9bcf30a0c0b1a96f815db9cdf99ff137f4449f

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2760	888	WerFault.exe	7679ebcd5161dcaa77c8a13cbb507ff7fc1568b1f571fdd9a61643dbe8f1ecaf.exe
4384	888	WerFault.exe	7679ebcd5161dcaa77c8a13cbb507ff7fc1568b1f571fdd9a61643dbe8f1ecaf.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

7679ebcd5161dcaa77c8a13cbb507ff7fc1568b1f571fdd9a61643dbe8f1ecaf.exe

description	pid	process	target process
PID 888 wrote to memory of 2760	888	7679ebcd5161dcaa77c8a13cbb507ff7fc1568b1f571fdd9a61643dbe8f1ecaf.exe	WerFault.exe
PID 888 wrote to memory of 2760	888	7679ebcd5161dcaa77c8a13cbb507ff7fc1568b1f571fdd9a61643dbe8f1ecaf.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7679ebcd5161dcaa77c8a13cbb507ff7fc1568b1f571fdd9a61643dbe8f1ecaf.exe
"C:\Users\Admin\AppData\Local\Temp\7679ebcd5161dcaa77c8a13cbb507ff7fc1568b1f571fdd9a61643dbe8f1ecaf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:888
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 888 -s 172
  2⤵
  - Program crash
  PID:2760
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 888 -s 172
  2⤵
  - Program crash
  PID:4384

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 368 -p 888 -ip 888
1⤵
PID:3168