cbda73ebcf4af6763dded20544a0658366740bbaf9791baf177391514498072b

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-04-2024 22:40

Target

out.exe
Size

756KB
MD5

396813ce52b3b3b72265c49ad799644e
SHA1

2aedcfeeca12618cd97d97f3df1c054db9eaeeed
SHA256

9f35b45413cfe29f0b19c3fcb7f2b614eb02eef59a7437f077d2187394e5174a
SHA512

5737ee264b53a5cbc9aadf9867b11138c725c3e4bb8687d2a5a5e9d3a6b7a194fe5625765ea95e3ea37fac7b53a2ff1fb27b1a3cb0d2e5b4c4393e48e59134fa
SSDEEP

12288:z9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkNC/u2ZChoJNr:9Z1xuVVjfFoynPaVBUR8f+kN10EdIhW

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process

3020 2912 WerFault.exe

pid	pid_target	process
3020	2912	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

out.exe

description	pid	process	target process
PID 2912 wrote to memory of 3020	2912	out.exe	WerFault.exe
PID 2912 wrote to memory of 3020	2912	out.exe	WerFault.exe
PID 2912 wrote to memory of 3020	2912	out.exe	WerFault.exe
PID 2912 wrote to memory of 3020	2912	out.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\out.exe
"C:\Users\Admin\AppData\Local\Temp\out.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 36
2⤵
- Program crash
PID:3020