3ef40b5cf78b87606cb6d32e3f4fc1704145de07e54140954c68365be9b75194

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:52

Target

3ef40b5cf78b87606cb6d32e3f4fc1704145de07e54140954c68365be9b75194.exe
Size

270KB
MD5

aa3d7919823912668f4befc3412b290e
SHA1

c5bd5b34da45859536f93f608597c1c881635e08
SHA256

3ef40b5cf78b87606cb6d32e3f4fc1704145de07e54140954c68365be9b75194
SHA512

55a26343570fca8088444a84fae3bd9910c69d9138e9395bd8bbdea4f85f542f7e0ae29f5e8107e26f41d35d388e7483aff1a41e35be567f5350bf015533e542
SSDEEP

6144:nzt4qRUF9aD4fY/RuDqPk3wBWgr4lsIY+qIF1AoWE7uCePK8YzSUF5fpfQBHTW9E:nWqRW9sKok3wBWgr4lzY+qIF1GEKC0R7

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2748 3028 WerFault.exe 3ef40b5cf78b87606cb6d32e3f4fc1704145de07e54140954c68365be9b75194.exe

pid	pid_target	process	target process
2748	3028	WerFault.exe	3ef40b5cf78b87606cb6d32e3f4fc1704145de07e54140954c68365be9b75194.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3ef40b5cf78b87606cb6d32e3f4fc1704145de07e54140954c68365be9b75194.exe

description	pid	process	target process
PID 3028 wrote to memory of 2748	3028	3ef40b5cf78b87606cb6d32e3f4fc1704145de07e54140954c68365be9b75194.exe	WerFault.exe
PID 3028 wrote to memory of 2748	3028	3ef40b5cf78b87606cb6d32e3f4fc1704145de07e54140954c68365be9b75194.exe	WerFault.exe
PID 3028 wrote to memory of 2748	3028	3ef40b5cf78b87606cb6d32e3f4fc1704145de07e54140954c68365be9b75194.exe	WerFault.exe
PID 3028 wrote to memory of 2748	3028	3ef40b5cf78b87606cb6d32e3f4fc1704145de07e54140954c68365be9b75194.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3ef40b5cf78b87606cb6d32e3f4fc1704145de07e54140954c68365be9b75194.exe
"C:\Users\Admin\AppData\Local\Temp\3ef40b5cf78b87606cb6d32e3f4fc1704145de07e54140954c68365be9b75194.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 36
  2⤵
  - Program crash
  PID:2748

memory/3028-0-0x0000000001000000-0x00000000010A5000-memory.dmp

Filesize
660KB

Download