e660be79de0932d6c5c0f1b65dc5d842ed790962625d5dd8731c30f46ae264a2

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 10:53

Target

005cc897c6fa2cdd0e0e44ec50a4f2ff3e7fa8269fe1ec09728e601cc06d9e01.exe
Size

283KB
MD5

ab86908cd76d8fb31acbc81f1d0e717f
SHA1

9305a283901636088d83878f39be40f161b4d3ec
SHA256

005cc897c6fa2cdd0e0e44ec50a4f2ff3e7fa8269fe1ec09728e601cc06d9e01
SHA512

19d5256e60f3b6d823750458897cdf3e527c57cb3fd660ecc879b6bdac01a6422bbbb55eea3bc55df8da38db36b542ddd414acb0f781f30ed260244300d76e90
SSDEEP

6144:cXTGyOUIEvHeY7FaDeSqq3SD5eP6pwMCPuAtPAJPCiaoAckl:cayOFEH9eiD5Dwf+xCiaoA3l

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1524 2892 WerFault.exe 005cc897c6fa2cdd0e0e44ec50a4f2ff3e7fa8269fe1ec09728e601cc06d9e01.exe

pid	pid_target	process	target process
1524	2892	WerFault.exe	005cc897c6fa2cdd0e0e44ec50a4f2ff3e7fa8269fe1ec09728e601cc06d9e01.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

005cc897c6fa2cdd0e0e44ec50a4f2ff3e7fa8269fe1ec09728e601cc06d9e01.exe

description	pid	process	target process
PID 2892 wrote to memory of 1524	2892	005cc897c6fa2cdd0e0e44ec50a4f2ff3e7fa8269fe1ec09728e601cc06d9e01.exe	WerFault.exe
PID 2892 wrote to memory of 1524	2892	005cc897c6fa2cdd0e0e44ec50a4f2ff3e7fa8269fe1ec09728e601cc06d9e01.exe	WerFault.exe
PID 2892 wrote to memory of 1524	2892	005cc897c6fa2cdd0e0e44ec50a4f2ff3e7fa8269fe1ec09728e601cc06d9e01.exe	WerFault.exe
PID 2892 wrote to memory of 1524	2892	005cc897c6fa2cdd0e0e44ec50a4f2ff3e7fa8269fe1ec09728e601cc06d9e01.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\005cc897c6fa2cdd0e0e44ec50a4f2ff3e7fa8269fe1ec09728e601cc06d9e01.exe
"C:\Users\Admin\AppData\Local\Temp\005cc897c6fa2cdd0e0e44ec50a4f2ff3e7fa8269fe1ec09728e601cc06d9e01.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 96
2⤵
- Program crash
PID:1524

memory/2892-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2892-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download