0a3e9e3f8bd96cf2377e396546c6abcd7d194977376fe97b0434468f108742da

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 18:28

Target

0a3e9e3f8bd96cf2377e396546c6abcd7d194977376fe97b0434468f108742da.exe
Size

20KB
MD5

3a7129ecccd5f7371bffebcf46355959
SHA1

e93cd52fccf5eecb954fad34686360697138d3ae
SHA256

0a3e9e3f8bd96cf2377e396546c6abcd7d194977376fe97b0434468f108742da
SHA512

12c38483b06e46ae3abdc4c7f2440ee187126fafa88fbc1c10c2427ed2dc890caa73e0cb2ad8676ebcf00e266a0ee94986c20300b895b86f1ed084ca1fb49886
SSDEEP

384:3grEQDC97ddK1MsQWRREHZszY1DPQCthN2QgX:Q4RtK1MshRS1PiHX

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2040 2988 WerFault.exe 0a3e9e3f8bd96cf2377e396546c6abcd7d194977376fe97b0434468f108742da.exe

pid	pid_target	process	target process
2040	2988	WerFault.exe	0a3e9e3f8bd96cf2377e396546c6abcd7d194977376fe97b0434468f108742da.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0a3e9e3f8bd96cf2377e396546c6abcd7d194977376fe97b0434468f108742da.exe

description	pid	process	target process
PID 2988 wrote to memory of 2040	2988	0a3e9e3f8bd96cf2377e396546c6abcd7d194977376fe97b0434468f108742da.exe	WerFault.exe
PID 2988 wrote to memory of 2040	2988	0a3e9e3f8bd96cf2377e396546c6abcd7d194977376fe97b0434468f108742da.exe	WerFault.exe
PID 2988 wrote to memory of 2040	2988	0a3e9e3f8bd96cf2377e396546c6abcd7d194977376fe97b0434468f108742da.exe	WerFault.exe
PID 2988 wrote to memory of 2040	2988	0a3e9e3f8bd96cf2377e396546c6abcd7d194977376fe97b0434468f108742da.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0a3e9e3f8bd96cf2377e396546c6abcd7d194977376fe97b0434468f108742da.exe
"C:\Users\Admin\AppData\Local\Temp\0a3e9e3f8bd96cf2377e396546c6abcd7d194977376fe97b0434468f108742da.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 88
2⤵
- Program crash
PID:2040