af5fc8115f184ea74a645c664a096cb0d275e94f2c5b004ebc0b13c9f40e51ce

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 07:30

Target

af5fc8115f184ea74a645c664a096cb0d275e94f2c5b004ebc0b13c9f40e51ce.exe
Size

316KB
MD5

cec5b5a0f4ac5de64aa1a13cc1daf94b
SHA1

34c83f89c4fb5d2f7eafa9fab7578960ee4e3e07
SHA256

af5fc8115f184ea74a645c664a096cb0d275e94f2c5b004ebc0b13c9f40e51ce
SHA512

02b43f9561d31454ec817d393814d2d672c5785074c1917136500fa5e89cd04338f496d2933f81099d301b1c0e6e52d0ade4236bc7b608dc7530ceed34828196
SSDEEP

3072:F8PoFoXLhhyPiTJTQBgpv7eRXxSY04KHwRjti049jGQxe73BZLraX/XjFeBnbnTJ:yA6Lh7TNDpDepIH6jtz49r0GrFAXTn1

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process

1352 660 WerFault.exe

pid	pid_target	process
1352	660	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

af5fc8115f184ea74a645c664a096cb0d275e94f2c5b004ebc0b13c9f40e51ce.exe

description	pid	process	target process
PID 660 wrote to memory of 1352	660	af5fc8115f184ea74a645c664a096cb0d275e94f2c5b004ebc0b13c9f40e51ce.exe	WerFault.exe
PID 660 wrote to memory of 1352	660	af5fc8115f184ea74a645c664a096cb0d275e94f2c5b004ebc0b13c9f40e51ce.exe	WerFault.exe
PID 660 wrote to memory of 1352	660	af5fc8115f184ea74a645c664a096cb0d275e94f2c5b004ebc0b13c9f40e51ce.exe	WerFault.exe
PID 660 wrote to memory of 1352	660	af5fc8115f184ea74a645c664a096cb0d275e94f2c5b004ebc0b13c9f40e51ce.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 660 -s 36
1⤵
- Program crash
PID:1352

C:\Users\Admin\AppData\Local\Temp\af5fc8115f184ea74a645c664a096cb0d275e94f2c5b004ebc0b13c9f40e51ce.exe
"C:\Users\Admin\AppData\Local\Temp\af5fc8115f184ea74a645c664a096cb0d275e94f2c5b004ebc0b13c9f40e51ce.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:660