44ee695b532eb984e46de29569ce35854b37d409efaabb6bcf9f5316e2b0546d

Resubmissions

18-04-2024 18:50

01-01-2024 15:12

max time kernel
1559s
max time network
1562s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 18:50

Target

de1793d8db7f58f0ef53bee7fb0942ef4c6c348e4a547b6cfeb74ffa8de56cdf.exe
Size

9.8MB
MD5

d07e516fdc1272e4e942e34a87f80e62
SHA1

22505c7dd91d27defe4ca7e6d6dfcb5aa46a0ea6
SHA256

de1793d8db7f58f0ef53bee7fb0942ef4c6c348e4a547b6cfeb74ffa8de56cdf
SHA512

fcb35f419bd089d2e4002e3dbd57082612dda8fb6d9b782bcede5a29ee63f1bd94f83e8b757dd89bc5c2930b9a3ad7fccf648bb3b83c43a4203e087e76bdc53d
SSDEEP

196608:L7uz6d21DDBeEEPpFYwUL4wi1c9en8Odqsem32RrpcNFmRMA67raxE:L7u+mwEEoRLmZnqs63/SuE

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2176 2060 WerFault.exe de1793d8db7f58f0ef53bee7fb0942ef4c6c348e4a547b6cfeb74ffa8de56cdf.exe

pid	pid_target	process	target process
2176	2060	WerFault.exe	de1793d8db7f58f0ef53bee7fb0942ef4c6c348e4a547b6cfeb74ffa8de56cdf.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

de1793d8db7f58f0ef53bee7fb0942ef4c6c348e4a547b6cfeb74ffa8de56cdf.exe

description	pid	process	target process
PID 2060 wrote to memory of 2176	2060	de1793d8db7f58f0ef53bee7fb0942ef4c6c348e4a547b6cfeb74ffa8de56cdf.exe	WerFault.exe
PID 2060 wrote to memory of 2176	2060	de1793d8db7f58f0ef53bee7fb0942ef4c6c348e4a547b6cfeb74ffa8de56cdf.exe	WerFault.exe
PID 2060 wrote to memory of 2176	2060	de1793d8db7f58f0ef53bee7fb0942ef4c6c348e4a547b6cfeb74ffa8de56cdf.exe	WerFault.exe
PID 2060 wrote to memory of 2176	2060	de1793d8db7f58f0ef53bee7fb0942ef4c6c348e4a547b6cfeb74ffa8de56cdf.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\de1793d8db7f58f0ef53bee7fb0942ef4c6c348e4a547b6cfeb74ffa8de56cdf.exe
"C:\Users\Admin\AppData\Local\Temp\de1793d8db7f58f0ef53bee7fb0942ef4c6c348e4a547b6cfeb74ffa8de56cdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 124
  2⤵
  - Program crash
  PID:2176