f66854431dc57070e060e776be18cba0992366fab22b71f8cf929b91c81a6c26

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 14:27

Target

2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe
Size

315KB
MD5

3d4c73f2d10c4ea03e9f55af41a02d7f
SHA1

e9f70b120dbab724b88c37161e5df5d8607d7500
SHA256

2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f
SHA512

05122b99c10edc0ea4b69f471daf0ce182268d505166e05a69757016f7f87b5e031911c8efd0e6722691b236df5bf2bef74f7a315d9c6c2c6d1e363bf9d98f27
SSDEEP

6144:rI9pI60nbM8uPZy3+8KID2YuDUtMXVgbhAZdxldn+kXHS:s9+60nbnuNYV2glAnjJZHS

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3064 1920 WerFault.exe 2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe

pid	pid_target	process	target process
3064	1920	WerFault.exe	2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe

description	pid	process	target process
PID 1920 wrote to memory of 3064	1920	2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe	WerFault.exe
PID 1920 wrote to memory of 3064	1920	2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe	WerFault.exe
PID 1920 wrote to memory of 3064	1920	2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe	WerFault.exe
PID 1920 wrote to memory of 3064	1920	2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe
"C:\Users\Admin\AppData\Local\Temp\2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 36
2⤵
- Program crash
PID:3064

memory/1920-0-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download