64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:34

Target

64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe
Size

822KB
MD5

e3b7b954d5742d1ae7381964a9fb78a8
SHA1

59d3311ea8be55d5eb4c29a849668ee0e48645e1
SHA256

64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62
SHA512

3d28ded2cdf8aa55c65d3c0d277a78bfd1666a3425615676d972015d1f26dbee676f7c73aea15743f42aad1e2a3a748d17d11f8adc892b4590a779b989b73503
SSDEEP

12288:kLP3rLTY5SYBzoXryJxsYXWCXqiBvIN12caVDh:kLkUY9oXC3XVXqiBWoV

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2696 2168 WerFault.exe 64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe

pid	pid_target	process	target process
2696	2168	WerFault.exe	64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe

description	pid	process	target process
PID 2168 wrote to memory of 2696	2168	64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe	WerFault.exe
PID 2168 wrote to memory of 2696	2168	64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe	WerFault.exe
PID 2168 wrote to memory of 2696	2168	64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe	WerFault.exe
PID 2168 wrote to memory of 2696	2168	64e27554be82e3699e82756de167566540d49eaed01d078173adb821f8977e62.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 836
2⤵
- Program crash
PID:2696

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1916

memory/2168-0-0x000000007420E000-0x000000007420F000-memory.dmp

Filesize
4KB

Download
memory/2168-1-0x0000000001380000-0x0000000001454000-memory.dmp

Filesize
848KB

Download
memory/2168-2-0x00000000002F0000-0x00000000002FE000-memory.dmp

Filesize
56KB

Download
memory/2168-3-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download
memory/2168-4-0x000000007420E000-0x000000007420F000-memory.dmp

Filesize
4KB

Download
memory/2168-5-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download