734403a96fad68cb2ef2b340adddd9cadd5894007aac703dcdb4a4cb8326c538

max time kernel
363s
max time network
374s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-03-2024 21:57

Sharing

Target

eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/Security Defender 2015/[email protected]
Size

1.2MB
MD5

d5e5853f5a2a5a7413f26c625c0e240b
SHA1

0ced68483e7f3742a963f2507937bb7089de3ffe
SHA256

415dd13c421a27ed96bf81579b112fbac05862405e9964e24ec8e9d4611d25f3
SHA512

49ea9ab92ce5832e702fac6f56a7f7168f60d8271419460ed27970c4a0400e996c2ea097636fc145e355c4df5cfbf200b7bf3c691133f72e4cad228f570b91e4
SSDEEP

12288:QH1eYXlVeneL/AuCeGhqzjheKTnHdQSR9wlPlVlbzl+lwlElPS3PomNX:QVZVeneLYcmiN7Q6Md3dMyuI

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1624 2460 WerFault.exe [email protected]

pid	pid_target	process	target process
1624	2460	WerFault.exe	[email protected]

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

description	pid	process	target process
PID 2460 wrote to memory of 1624	2460	[email protected]	WerFault.exe
PID 2460 wrote to memory of 1624	2460	[email protected]	WerFault.exe
PID 2460 wrote to memory of 1624	2460	[email protected]	WerFault.exe
PID 2460 wrote to memory of 1624	2460	[email protected]	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\Security Defender 2015\[email protected]
"C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\Security Defender 2015\[email protected]"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 152
  2⤵
  - Program crash
  PID:1624

memory/2460-0-0x0000000000AB0000-0x0000000000BEB000-memory.dmp

Filesize
1.2MB

Download