0c0795955730ac1988aa527cd4dc21d9c8ac7ae9d4837b5e63f50e870171ec87

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 01:26

Target

software2_17_6_23/loader.exe
Size

460KB
MD5

8a1801714426d29d63eb25aa92f402a9
SHA1

a6861884cbde9e99d23a4ce6bb221a6dddb4ed54
SHA256

1345bdc232ecd7cfb835fe479ad5c172a59c18477bdc130ff0d492be56ce445f
SHA512

0dee009f6074db73d3f5b3edda5b9305ed9134abc867f41f6217b3cb250c8511f9fc03b552adb0f80e8845cb02b829fc87ed6d571fb21abd008535e0bf4df9a4
SSDEEP

6144:QpxFEXF3kSfQJ0SlD9tH/xR0h3uFEmLAuIHbXInETPmDF69pVYx/RKlDa+3VgmwA:gxFi00sr/63uFTkcns93kRMu+qpm

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2944 3056 WerFault.exe loader.exe

pid	pid_target	process	target process
2944	3056	WerFault.exe	loader.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

loader.exe

description	pid	process	target process
PID 3056 wrote to memory of 2944	3056	loader.exe	WerFault.exe
PID 3056 wrote to memory of 2944	3056	loader.exe	WerFault.exe
PID 3056 wrote to memory of 2944	3056	loader.exe	WerFault.exe
PID 3056 wrote to memory of 2944	3056	loader.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\software2_17_6_23\loader.exe
"C:\Users\Admin\AppData\Local\Temp\software2_17_6_23\loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 120
2⤵
- Program crash
PID:2944

memory/3056-0-0x0000000001390000-0x0000000001404000-memory.dmp

Filesize
464KB

Download