f66854431dc57070e060e776be18cba0992366fab22b71f8cf929b91c81a6c26

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 14:27

Target

eadc8b7eba6e15614161bb91b8de6cff4d56f767901f6aceb9baed7b0fe0b110.exe
Size

333KB
MD5

3c77db8ee7d08d76b14c5fc09137df15
SHA1

cc7f65cf6094c1cef4533d73b969a3c0a719d5ff
SHA256

eadc8b7eba6e15614161bb91b8de6cff4d56f767901f6aceb9baed7b0fe0b110
SHA512

6c9d537c77b713356587a42fc487979058cd63b6d428802565aa9ac6f83beccd5fb23ed96ed32f09e07573c05e3018b1d96515f0762a9c5c0fe8b8ba44a3f288
SSDEEP

6144:e1RwZfFQDOioMvzATd5W0jbSXRYygh2qjjjjjjjJ42J2VfdweP4ql732W1sV+0Xp:e/zDOioMvzA+iygAqjjjjjjjJafKxI3W

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2216 2272 WerFault.exe eadc8b7eba6e15614161bb91b8de6cff4d56f767901f6aceb9baed7b0fe0b110.exe

pid	pid_target	process	target process
2216	2272	WerFault.exe	eadc8b7eba6e15614161bb91b8de6cff4d56f767901f6aceb9baed7b0fe0b110.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

eadc8b7eba6e15614161bb91b8de6cff4d56f767901f6aceb9baed7b0fe0b110.exe

description	pid	process	target process
PID 2272 wrote to memory of 2216	2272	eadc8b7eba6e15614161bb91b8de6cff4d56f767901f6aceb9baed7b0fe0b110.exe	WerFault.exe
PID 2272 wrote to memory of 2216	2272	eadc8b7eba6e15614161bb91b8de6cff4d56f767901f6aceb9baed7b0fe0b110.exe	WerFault.exe
PID 2272 wrote to memory of 2216	2272	eadc8b7eba6e15614161bb91b8de6cff4d56f767901f6aceb9baed7b0fe0b110.exe	WerFault.exe
PID 2272 wrote to memory of 2216	2272	eadc8b7eba6e15614161bb91b8de6cff4d56f767901f6aceb9baed7b0fe0b110.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\eadc8b7eba6e15614161bb91b8de6cff4d56f767901f6aceb9baed7b0fe0b110.exe
"C:\Users\Admin\AppData\Local\Temp\eadc8b7eba6e15614161bb91b8de6cff4d56f767901f6aceb9baed7b0fe0b110.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 52
2⤵
- Program crash
PID:2216

memory/2272-0-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2272-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download