3c2072fbeefc8a27e863c1c8db50562535f7078ce40192a5e2188dacd89fe1e0

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 18:12

Target
20240522de5a0fe7e61c32a314db9f0486d93abbstop.exe
Size 1.1MB
Sample240522-ws5d2abd8x
SHA256 3c2072fbeefc8a27e863c1c8db50562535f7078ce40192a5e2188dacd89fe1e0
MD5 de5a0fe7e61c32a314db9f0486d93abb
SHA1 46bea4cdd09a763be10b5b6db7d16497a9f6bff0
SHA512 ef3aaae9cd648ce2acd49b24ae5de4e4cc6bb77aac63ce3159a2d391ddc149bafa6421816c7e5a381701d3c92df4fe90222151bd1baa1f81b0cd5dabe0660947
SSDEEP 24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/XRPOO8SbHUq7:F0dwAYZt6C31WeTPRPOhSTUq7
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2152	2300	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2152	2300	20240522de5a0fe7e61c32a314db9f0486d93abbstop.exe	28
PID 2300 wrote to memory of 2152	2300	20240522de5a0fe7e61c32a314db9f0486d93abbstop.exe	28
PID 2300 wrote to memory of 2152	2300	20240522de5a0fe7e61c32a314db9f0486d93abbstop.exe	28
PID 2300 wrote to memory of 2152	2300	20240522de5a0fe7e61c32a314db9f0486d93abbstop.exe	28

C:\Users\Admin\AppData\Local\Temp\20240522de5a0fe7e61c32a314db9f0486d93abbstop.exe
"C:\Users\Admin\AppData\Local\Temp\20240522de5a0fe7e61c32a314db9f0486d93abbstop.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 192
  2⤵
  - Program crash
  PID:2152