a3662b8fdd77511e2b5bb91e2797ff4076555fe3360b88198e078932d131e53d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09-01-2024 13:25

Target

4e6bccd94552190533e28058092b989e.exe
Size

1.2MB
MD5

4e6bccd94552190533e28058092b989e
SHA1

b76e030c15bcc91a1336c820db04b76350b7b512
SHA256

a3662b8fdd77511e2b5bb91e2797ff4076555fe3360b88198e078932d131e53d
SHA512

4c65b55963d48d7ddabecd8df36c6541b65857de063ee9407126adee9f7f475c6a10ca812bc9c681750f03290cc393116a7a8c2d4542ffa41315b4832d21e71e
SSDEEP

24576:dHtFjGDfUmf6oIDADj41g3gpzQn65O5C9OkLBlgVIH06iyx:AyDcVJU4qB2IU6iO

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3040 2996 WerFault.exe 4e6bccd94552190533e28058092b989e.exe

pid	pid_target	process	target process
3040	2996	WerFault.exe	4e6bccd94552190533e28058092b989e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4e6bccd94552190533e28058092b989e.exe

description	pid	process	target process
PID 2996 wrote to memory of 3040	2996	4e6bccd94552190533e28058092b989e.exe	WerFault.exe
PID 2996 wrote to memory of 3040	2996	4e6bccd94552190533e28058092b989e.exe	WerFault.exe
PID 2996 wrote to memory of 3040	2996	4e6bccd94552190533e28058092b989e.exe	WerFault.exe
PID 2996 wrote to memory of 3040	2996	4e6bccd94552190533e28058092b989e.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4e6bccd94552190533e28058092b989e.exe
"C:\Users\Admin\AppData\Local\Temp\4e6bccd94552190533e28058092b989e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 128
  2⤵
  - Program crash
  PID:3040