92e5a2fb9c2403bcdfffc5d91c7cc959da76e0ddd843b2d43a8a3a858f9c90a6

Analysis

max time kernel
5s
max time network
1s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 16:53

Target

9e4e60ee2a8a8ce65072e3aa9b648d4e8ff45474a41d374126f3c045901550c6.exe
Size

202KB
MD5

b3cc04eac72aca2c23989d65ba0e1547
SHA1

c79584523f978085fe5eec0730118212cab4fcb5
SHA256

9e4e60ee2a8a8ce65072e3aa9b648d4e8ff45474a41d374126f3c045901550c6
SHA512

ebea0d6af15fcca8646b1e1692f52d9aa3ecd1ca33bb1f7eeb0453f1311536bb0d0b7c3c8e6e199aadfc1ae2954b0aad15abb2d2d3b3f7bf5ea8ee01414aac0f
SSDEEP

6144:qv7rhkKYs1pKlCqLi4JH7GEG0C8i/KZWyV:w7rhk8WWulC8ia1V

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2584 2328 WerFault.exe 9e4e60ee2a8a8ce65072e3aa9b648d4e8ff45474a41d374126f3c045901550c6.exe

pid	pid_target	process	target process
2584	2328	WerFault.exe	9e4e60ee2a8a8ce65072e3aa9b648d4e8ff45474a41d374126f3c045901550c6.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9e4e60ee2a8a8ce65072e3aa9b648d4e8ff45474a41d374126f3c045901550c6.exe

description	pid	process	target process
PID 2328 wrote to memory of 2584	2328	9e4e60ee2a8a8ce65072e3aa9b648d4e8ff45474a41d374126f3c045901550c6.exe	WerFault.exe
PID 2328 wrote to memory of 2584	2328	9e4e60ee2a8a8ce65072e3aa9b648d4e8ff45474a41d374126f3c045901550c6.exe	WerFault.exe
PID 2328 wrote to memory of 2584	2328	9e4e60ee2a8a8ce65072e3aa9b648d4e8ff45474a41d374126f3c045901550c6.exe	WerFault.exe
PID 2328 wrote to memory of 2584	2328	9e4e60ee2a8a8ce65072e3aa9b648d4e8ff45474a41d374126f3c045901550c6.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9e4e60ee2a8a8ce65072e3aa9b648d4e8ff45474a41d374126f3c045901550c6.exe
"C:\Users\Admin\AppData\Local\Temp\9e4e60ee2a8a8ce65072e3aa9b648d4e8ff45474a41d374126f3c045901550c6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 124
2⤵
- Program crash
PID:2584