e604d5e210fbe81f3a5a8a3408724c516b41898e674b6ffe2b25e8e9d2343e63

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 18:46

Target

e604d5e210fbe81f3a5a8a3408724c516b41898e674b6ffe2b25e8e9d2343e63.exe
Size

155KB
MD5

770dbf494e8a94aaa9c407a9283f5f3a
SHA1

cc46dc4ee85ce2b1ae13ed4edc5085a04cd94634
SHA256

e604d5e210fbe81f3a5a8a3408724c516b41898e674b6ffe2b25e8e9d2343e63
SHA512

16277916933e19313f355fead1b7395a714352db71979858916fdd0acf5c5784f457eab08b7663c4a32d599988c84e6f2a130b9b3aaa875753e37808245a7318
SSDEEP

1536:BUFOA/qfBSEawJiMFoMcJS8SNu3NbfO5rKJZp0wFti5n4jSmhHg2j554hEB/dBa:iF4SRiouNngAx8h5dZdhfqTQn4M

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2176 1152 WerFault.exe e604d5e210fbe81f3a5a8a3408724c516b41898e674b6ffe2b25e8e9d2343e63.exe

pid	pid_target	process	target process
2176	1152	WerFault.exe	e604d5e210fbe81f3a5a8a3408724c516b41898e674b6ffe2b25e8e9d2343e63.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e604d5e210fbe81f3a5a8a3408724c516b41898e674b6ffe2b25e8e9d2343e63.exe

description	pid	process	target process
PID 1152 wrote to memory of 2176	1152	e604d5e210fbe81f3a5a8a3408724c516b41898e674b6ffe2b25e8e9d2343e63.exe	WerFault.exe
PID 1152 wrote to memory of 2176	1152	e604d5e210fbe81f3a5a8a3408724c516b41898e674b6ffe2b25e8e9d2343e63.exe	WerFault.exe
PID 1152 wrote to memory of 2176	1152	e604d5e210fbe81f3a5a8a3408724c516b41898e674b6ffe2b25e8e9d2343e63.exe	WerFault.exe
PID 1152 wrote to memory of 2176	1152	e604d5e210fbe81f3a5a8a3408724c516b41898e674b6ffe2b25e8e9d2343e63.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e604d5e210fbe81f3a5a8a3408724c516b41898e674b6ffe2b25e8e9d2343e63.exe
"C:\Users\Admin\AppData\Local\Temp\e604d5e210fbe81f3a5a8a3408724c516b41898e674b6ffe2b25e8e9d2343e63.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 140
2⤵
- Program crash
PID:2176

memory/1152-0-0x0000000000C90000-0x0000000000CC4000-memory.dmp

Filesize
208KB

Download