ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61

Resubmissions

17-05-2024 23:39

31-03-2024 18:02

31-03-2024 17:58

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31-03-2024 17:58

Target

ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe
Size

754KB
MD5

f1fdda86a94e2d1abbd244089d73752f
SHA1

70f8defd6b861717142d7db8a1fe2be6a34a5b13
SHA256

ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61
SHA512

6a4fb99c397b55a61be466f52a83dd9fade0e022f5cd3cdb18411069cea6b0f2ae85f980555e62b710955ce1083ed11377c2bcce495f6a6012dd3e2b4325f18c
SSDEEP

6144:VQM3xHba9C4q/HVF7eHpnTHzJEWyLBMRJDL+gpFfD2l9pAZcXXkqD:V3x7a9a8HdPjX+gpFfDO0+XX

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1612 1220 WerFault.exe ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe

pid	pid_target	process	target process
1612	1220	WerFault.exe	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe

description	pid	process	target process
PID 1220 wrote to memory of 1612	1220	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe	WerFault.exe
PID 1220 wrote to memory of 1612	1220	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe	WerFault.exe
PID 1220 wrote to memory of 1612	1220	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe	WerFault.exe
PID 1220 wrote to memory of 1612	1220	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe
"C:\Users\Admin\AppData\Local\Temp\ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 120
2⤵
- Program crash
PID:1612

memory/1220-0-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download