dfffd91eb0fda923a4aac85438d83b6605881614c1055d757c975c96ecb20fbf

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 19:21

Target

dfffd91eb0fda923a4aac85438d83b6605881614c1055d757c975c96ecb20fbf.exe
Size

448KB
MD5

d0bc00728ccfa5b0b82675d525665525
SHA1

9118c8a653625a1959351a4847140a9edf3d5c64
SHA256

dfffd91eb0fda923a4aac85438d83b6605881614c1055d757c975c96ecb20fbf
SHA512

99a4817c152b5642559d3bb380ed0300d7c8048fa3e1dc5688d631b23a82203bb93b0e9f0f83a24d304d7e1516a7025959eff0371802b4c150299957c103220e
SSDEEP

12288:cjqzMk8xN/8QsNDZqiB177Fn8s8tzAp6HY7R79VV:YqdQXsNdR7Fn/8tzu3F79f

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1592 2820 WerFault.exe dfffd91eb0fda923a4aac85438d83b6605881614c1055d757c975c96ecb20fbf.exe

pid	pid_target	process	target process
1592	2820	WerFault.exe	dfffd91eb0fda923a4aac85438d83b6605881614c1055d757c975c96ecb20fbf.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

dfffd91eb0fda923a4aac85438d83b6605881614c1055d757c975c96ecb20fbf.exe

description	pid	process	target process
PID 2820 wrote to memory of 1592	2820	dfffd91eb0fda923a4aac85438d83b6605881614c1055d757c975c96ecb20fbf.exe	WerFault.exe
PID 2820 wrote to memory of 1592	2820	dfffd91eb0fda923a4aac85438d83b6605881614c1055d757c975c96ecb20fbf.exe	WerFault.exe
PID 2820 wrote to memory of 1592	2820	dfffd91eb0fda923a4aac85438d83b6605881614c1055d757c975c96ecb20fbf.exe	WerFault.exe
PID 2820 wrote to memory of 1592	2820	dfffd91eb0fda923a4aac85438d83b6605881614c1055d757c975c96ecb20fbf.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\dfffd91eb0fda923a4aac85438d83b6605881614c1055d757c975c96ecb20fbf.exe
"C:\Users\Admin\AppData\Local\Temp\dfffd91eb0fda923a4aac85438d83b6605881614c1055d757c975c96ecb20fbf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 204
2⤵
- Program crash
PID:1592