38d9e0e1162eee88fbabb5394bc4de79afd492c4bfa88b6edcb7ae9a72c4ab04

Analysis

max time kernel
150s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08-06-2023 20:15

Target

38d9e0e1162eee88fbabb5394bc4de79afd492c4bfa88b6edcb7ae9a72c4ab04.exe
Size

1.1MB
MD5

6cd5b62637a864ecbc902ac769f96fb3
SHA1

e0192b0c642277d4d04ab6de3f7182b1f4155835
SHA256

38d9e0e1162eee88fbabb5394bc4de79afd492c4bfa88b6edcb7ae9a72c4ab04
SHA512

52167515987c222a6b9221671a99b4c1944800d82c15daa90d29094165cd52cda3a2533a55786fef465544ad60b0738581680d27d5330f4aaf58e70a663822e6
SSDEEP

24576:44jZgQfcJ8szLSFI5Mx3Z+ZtestXTF/c1CjaLD:NZ5fJgLSF5x3ZigstxoJLD

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1020 1556 WerFault.exe 38d9e0e1162eee88fbabb5394bc4de79afd492c4bfa88b6edcb7ae9a72c4ab04.exe

pid	pid_target	process	target process
1020	1556	WerFault.exe	38d9e0e1162eee88fbabb5394bc4de79afd492c4bfa88b6edcb7ae9a72c4ab04.exe

Modifies Control Panel 3 IoCs

evasion

Processes:

38d9e0e1162eee88fbabb5394bc4de79afd492c4bfa88b6edcb7ae9a72c4ab04.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\International\iDate = "2"	38d9e0e1162eee88fbabb5394bc4de79afd492c4bfa88b6edcb7ae9a72c4ab04.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\International\sDate = "-"	38d9e0e1162eee88fbabb5394bc4de79afd492c4bfa88b6edcb7ae9a72c4ab04.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\International\sShortDate = "yyyy-MM-dd"	38d9e0e1162eee88fbabb5394bc4de79afd492c4bfa88b6edcb7ae9a72c4ab04.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

38d9e0e1162eee88fbabb5394bc4de79afd492c4bfa88b6edcb7ae9a72c4ab04.exe

description	pid	process	target process
PID 1556 wrote to memory of 1020	1556	38d9e0e1162eee88fbabb5394bc4de79afd492c4bfa88b6edcb7ae9a72c4ab04.exe	WerFault.exe
PID 1556 wrote to memory of 1020	1556	38d9e0e1162eee88fbabb5394bc4de79afd492c4bfa88b6edcb7ae9a72c4ab04.exe	WerFault.exe
PID 1556 wrote to memory of 1020	1556	38d9e0e1162eee88fbabb5394bc4de79afd492c4bfa88b6edcb7ae9a72c4ab04.exe	WerFault.exe
PID 1556 wrote to memory of 1020	1556	38d9e0e1162eee88fbabb5394bc4de79afd492c4bfa88b6edcb7ae9a72c4ab04.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 644
2⤵
- Program crash
PID:1020

memory/1556-54-0x0000000000400000-0x00000000007EF000-memory.dmp

Filesize
3.9MB

Download
memory/1556-56-0x0000000000400000-0x00000000007EF000-memory.dmp

Filesize
3.9MB

Download
memory/1556-55-0x0000000000400000-0x00000000007EF000-memory.dmp

Filesize
3.9MB

Download
memory/1556-57-0x0000000000400000-0x00000000007EF000-memory.dmp

Filesize
3.9MB

Download
memory/1556-58-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1556-59-0x0000000000400000-0x00000000007EF000-memory.dmp

Filesize
3.9MB

Download
memory/1556-61-0x0000000000400000-0x00000000007EF000-memory.dmp

Filesize
3.9MB

Download
memory/1556-63-0x0000000000400000-0x00000000007EF000-memory.dmp

Filesize
3.9MB

Download