31fcc1a7c79fa0e760d81e479154824551be394658821275380c9fc45343ae22

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
13-08-2023 18:33

Target

Zver.exe
Size

587KB
MD5

fbc7e2ab249193e054efd4fccd18bc53
SHA1

4ff3c8466bb95053ebb448d9aa700d5edbf0c0c9
SHA256

ec4ea4cf8c0583898bfafe4994c822f4f2848e996431c1847d9acac0d30c8a63
SHA512

fa2f43fc5cd06f2d492ece30142a91d821e6827b17e5b9d1077a8eeff097533deecc79ae3119f2db2f14ab3ee3f034fcce5d096515e71f555b3e05001056bacc
SSDEEP

12288:Z+v9e7pXF7UERD7jCYp66lpzLDzAy0NQLvDh/i69wP:C9e3PmalpzLPeQ3hEP

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2020 2388 WerFault.exe Zver.exe

pid	pid_target	process	target process
2020	2388	WerFault.exe	Zver.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Zver.exe

description	pid	process	target process
PID 2388 wrote to memory of 2020	2388	Zver.exe	WerFault.exe
PID 2388 wrote to memory of 2020	2388	Zver.exe	WerFault.exe
PID 2388 wrote to memory of 2020	2388	Zver.exe	WerFault.exe
PID 2388 wrote to memory of 2020	2388	Zver.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Zver.exe
"C:\Users\Admin\AppData\Local\Temp\Zver.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 564
2⤵
- Program crash
PID:2020

memory/2388-54-0x0000000000B30000-0x0000000000B72000-memory.dmp

Filesize
264KB

Download
memory/2388-55-0x0000000074B30000-0x000000007521E000-memory.dmp

Filesize
6.9MB

Download
memory/2388-56-0x0000000004420000-0x0000000004460000-memory.dmp

Filesize
256KB

Download
memory/2388-57-0x0000000074B30000-0x000000007521E000-memory.dmp

Filesize
6.9MB

Download
memory/2388-58-0x0000000004420000-0x0000000004460000-memory.dmp

Filesize
256KB

Download