de36e0af9cd7e32d781be2ab937a7dca33a9f93dcbecd06ff944641e5196c51f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:28

Target

de36e0af9cd7e32d781be2ab937a7dca33a9f93dcbecd06ff944641e5196c51f.exe
Size

5.5MB
MD5

461e951ba79964b681e9a8bc9d61a92c
SHA1

c860285cc237d35022fea21eba03c82e86ea3d1e
SHA256

de36e0af9cd7e32d781be2ab937a7dca33a9f93dcbecd06ff944641e5196c51f
SHA512

b85af74593267854a24d9a03a046c3d00cfd25401a9b304061f508d46c559e4773801dda28c0a54c15b2c9334fbfa2f391be9194828334cbe4be50811ed0c19f
SSDEEP

98304:28DaacSl8Gb4CieDNDQfCmzgHCS5nidPDjJ4zfm4xrXEkuJTQS383:28eacSl8Gb4CieDNDcCoynQPDyZxcTr3

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1652 2944 WerFault.exe de36e0af9cd7e32d781be2ab937a7dca33a9f93dcbecd06ff944641e5196c51f.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

de36e0af9cd7e32d781be2ab937a7dca33a9f93dcbecd06ff944641e5196c51f.exe

pid process

2944 de36e0af9cd7e32d781be2ab937a7dca33a9f93dcbecd06ff944641e5196c51f.exe

pid	pid_target	process	target process
1652	2944	WerFault.exe	de36e0af9cd7e32d781be2ab937a7dca33a9f93dcbecd06ff944641e5196c51f.exe

pid	process
2944	de36e0af9cd7e32d781be2ab937a7dca33a9f93dcbecd06ff944641e5196c51f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

de36e0af9cd7e32d781be2ab937a7dca33a9f93dcbecd06ff944641e5196c51f.exe

description	pid	process	target process
PID 2944 wrote to memory of 1652	2944	de36e0af9cd7e32d781be2ab937a7dca33a9f93dcbecd06ff944641e5196c51f.exe	WerFault.exe
PID 2944 wrote to memory of 1652	2944	de36e0af9cd7e32d781be2ab937a7dca33a9f93dcbecd06ff944641e5196c51f.exe	WerFault.exe
PID 2944 wrote to memory of 1652	2944	de36e0af9cd7e32d781be2ab937a7dca33a9f93dcbecd06ff944641e5196c51f.exe	WerFault.exe
PID 2944 wrote to memory of 1652	2944	de36e0af9cd7e32d781be2ab937a7dca33a9f93dcbecd06ff944641e5196c51f.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 228
2⤵
- Program crash
PID:1652