f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 01:02

Target

f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Size

56KB
MD5

3f2cb535fc5bc296aa5b0d2897c265d0
SHA1

c30358563fa940eb5cd6064d4d16defee43b0310
SHA256

f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4
SHA512

6fc3a98f16f4fbd2e6bd4211c35b403ed565d6b30f803e6da04e14efe018aca09719256f1e8a2c8a5763a7bac08de3be964eb6251d858df0f6261f82b3f2f7a2
SSDEEP

768:piN4q1eksgR4SiI+rxQ3rjFrXRRWxXyw/Afy8fIaJ/ZB49j9xOOLC9kvAx0:g4HHerjZX7pLjJKjSO+i

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2952	2924	WerFault.exe	29

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2924	2928	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe	29
PID 2928 wrote to memory of 2924	2928	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe	29
PID 2928 wrote to memory of 2924	2928	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe	29
PID 2928 wrote to memory of 2924	2928	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe	29
PID 2928 wrote to memory of 2924	2928	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe	29

C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
"C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe"
1⤵
PID:2856

C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
"C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
  "C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 440
    3⤵
    - Program crash
    PID:2952