734403a96fad68cb2ef2b340adddd9cadd5894007aac703dcdb4a4cb8326c538

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-03-2024 19:27

Sharing

Target

eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/Security Defender 2015/[email protected]
Size

1.2MB
MD5

d5e5853f5a2a5a7413f26c625c0e240b
SHA1

0ced68483e7f3742a963f2507937bb7089de3ffe
SHA256

415dd13c421a27ed96bf81579b112fbac05862405e9964e24ec8e9d4611d25f3
SHA512

49ea9ab92ce5832e702fac6f56a7f7168f60d8271419460ed27970c4a0400e996c2ea097636fc145e355c4df5cfbf200b7bf3c691133f72e4cad228f570b91e4
SSDEEP

12288:QH1eYXlVeneL/AuCeGhqzjheKTnHdQSR9wlPlVlbzl+lwlElPS3PomNX:QVZVeneLYcmiN7Q6Md3dMyuI

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2508 1940 WerFault.exe [email protected]

pid	pid_target	process	target process
2508	1940	WerFault.exe	[email protected]

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

description	pid	process	target process
PID 1940 wrote to memory of 2508	1940	[email protected]	WerFault.exe
PID 1940 wrote to memory of 2508	1940	[email protected]	WerFault.exe
PID 1940 wrote to memory of 2508	1940	[email protected]	WerFault.exe
PID 1940 wrote to memory of 2508	1940	[email protected]	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\Security Defender 2015\[email protected]
"C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\Security Defender 2015\[email protected]"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 152
2⤵
- Program crash
PID:2508

memory/1940-0-0x00000000000A0000-0x00000000001DB000-memory.dmp

Filesize
1.2MB

Download