0f808fd3ecf9d722aafeee46b57aad4d07f39c98be6f6148be979ed470cf0a99

Resubmissions

27-01-2024 19:37

27-01-2024 19:36

12-05-2021 15:56

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27-01-2024 19:37

Target

3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6.exe
Size

59KB
MD5

c4f1a1b73e4af0fbb63af8ee89a5a7fe
SHA1

5604a48ce74124fb478049976db48197896b6743
SHA256

3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6
SHA512

67e6b184b926b1de2fa1d4c429db33b4b4146a0c5eb6929422d6ec161654fc634dce7810a1deb0befdf7d932df1edfc02251d8193272c1d1c713a1df8da32ceb
SSDEEP

768:Dbj5aI1NaUzt023Zexasb1w/WF4BtCCuSbVQdNcxGV1ylqdwB:FNaUzt02pSaq1wT4rxDTV1ylqdwB

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process

2104 2108 WerFault.exe

pid	pid_target	process
2104	2108	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6.exe

description	pid	process	target process
PID 2108 wrote to memory of 2104	2108	3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6.exe	WerFault.exe
PID 2108 wrote to memory of 2104	2108	3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6.exe	WerFault.exe
PID 2108 wrote to memory of 2104	2108	3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6.exe	WerFault.exe
PID 2108 wrote to memory of 2104	2108	3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 36
1⤵
- Program crash
PID:2104

C:\Users\Admin\AppData\Local\Temp\3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6.exe
"C:\Users\Admin\AppData\Local\Temp\3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2108