efe008ef2d2f134b3dc13b0e7774cf5afaac37652f491658b45665e175cf12b9

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 14:15

Target

677afbc18346258efc780d794cf589d9e949ec77c0f68fc663b38c6f663cf7fd.exe
Size

467KB
MD5

3ef1aae1590eb138e6444db02fd3c1c1
SHA1

d8906538be380eecb256132a5a87682d8b14e254
SHA256

677afbc18346258efc780d794cf589d9e949ec77c0f68fc663b38c6f663cf7fd
SHA512

9146ebe581ffa7bae67a8bf74969e8144c4d059c3409d75a20b40771b8d6511f9ec5c49a2a0664646798d6b21094d3b8b5cb8ae4992d3a03e5c6bfa34c27d694
SSDEEP

12288:iZZE67b6ybYwz3EtKooU0EpPSnGkOaPVDOQSFv3uMyL98F:6G6/bYvt10EpPSGkOaPoMRZu

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3012 2180 WerFault.exe 677afbc18346258efc780d794cf589d9e949ec77c0f68fc663b38c6f663cf7fd.exe

pid	pid_target	process	target process
3012	2180	WerFault.exe	677afbc18346258efc780d794cf589d9e949ec77c0f68fc663b38c6f663cf7fd.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

677afbc18346258efc780d794cf589d9e949ec77c0f68fc663b38c6f663cf7fd.exe

description	pid	process	target process
PID 2180 wrote to memory of 3012	2180	677afbc18346258efc780d794cf589d9e949ec77c0f68fc663b38c6f663cf7fd.exe	WerFault.exe
PID 2180 wrote to memory of 3012	2180	677afbc18346258efc780d794cf589d9e949ec77c0f68fc663b38c6f663cf7fd.exe	WerFault.exe
PID 2180 wrote to memory of 3012	2180	677afbc18346258efc780d794cf589d9e949ec77c0f68fc663b38c6f663cf7fd.exe	WerFault.exe
PID 2180 wrote to memory of 3012	2180	677afbc18346258efc780d794cf589d9e949ec77c0f68fc663b38c6f663cf7fd.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\677afbc18346258efc780d794cf589d9e949ec77c0f68fc663b38c6f663cf7fd.exe
"C:\Users\Admin\AppData\Local\Temp\677afbc18346258efc780d794cf589d9e949ec77c0f68fc663b38c6f663cf7fd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 88
  2⤵
  - Program crash
  PID:3012

memory/2180-0-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download