ebd9a15280a9fbd641ead11a6ab911fd72dcd48a6226e2e161005aebc9f70813

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 07:51

Target

60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe
Size

435KB
MD5

65574cb9beeaff86146f6f2ec8cea86f
SHA1

9ca2c27c6efb5895dd9583ce451cd8fa65f4d5f6
SHA256

60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7
SHA512

d5119d3a1d2ed3f3f3002c5745595c3bf86d8476563ffae8cd7933e5acf3860e0083decb18f9bfe7a27b463fa68a6eba9f9e05cff5bdbcd9ae112a15a61f57de
SSDEEP

12288:tcY4vLQ+mSA9L9mmzs5CdJ00vYUcYsTHMpH:gEXSAh9mmzWCD0sDcDcH

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2412 1208 WerFault.exe 60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe

pid	pid_target	process	target process
2412	1208	WerFault.exe	60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe

description	pid	process	target process
PID 1208 wrote to memory of 2412	1208	60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe	WerFault.exe
PID 1208 wrote to memory of 2412	1208	60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe	WerFault.exe
PID 1208 wrote to memory of 2412	1208	60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe	WerFault.exe
PID 1208 wrote to memory of 2412	1208	60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe
"C:\Users\Admin\AppData\Local\Temp\60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 120
  2⤵
  - Program crash
  PID:2412

memory/1208-0-0x0000000000329000-0x000000000032A000-memory.dmp

Filesize
4KB

Download