012e5ef35e2f13676d6141ea12f8ad4659d8fbdea99c244c995d46e78e5b2d17

Analysis

max time kernel
131s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 01:00

Target

012e5ef35e2f13676d6141ea12f8ad4659d8fbdea99c244c995d46e78e5b2d17.exe
Size

1.4MB
MD5

02534060c07286b6c06db8b181509fb9
SHA1

eed82ba0c6cc7cc4d7c8a61844e0e84d440ebe03
SHA256

012e5ef35e2f13676d6141ea12f8ad4659d8fbdea99c244c995d46e78e5b2d17
SHA512

1ebea9a686adb6835c8778fd8a477c2ede69830ff24c5f8cb5d803ea7ed65174624afafb0a7e0b66c9d6ec0a0c4605d2ff17de565822ab4bc8e513d0cc878844
SSDEEP

24576:yn25nPkW3amy8sQxeWcktTjbJ42auDyEEEEEEEEEEEEEEEEEEEETKKKKKKKKKKKr:yn2kGy7wTjbX/DyEEEEEEEEEEEEEEEEm

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

840 1152 WerFault.exe 012e5ef35e2f13676d6141ea12f8ad4659d8fbdea99c244c995d46e78e5b2d17.exe

pid	pid_target	process	target process
840	1152	WerFault.exe	012e5ef35e2f13676d6141ea12f8ad4659d8fbdea99c244c995d46e78e5b2d17.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

012e5ef35e2f13676d6141ea12f8ad4659d8fbdea99c244c995d46e78e5b2d17.exe

description	pid	process	target process
PID 1152 wrote to memory of 840	1152	012e5ef35e2f13676d6141ea12f8ad4659d8fbdea99c244c995d46e78e5b2d17.exe	WerFault.exe
PID 1152 wrote to memory of 840	1152	012e5ef35e2f13676d6141ea12f8ad4659d8fbdea99c244c995d46e78e5b2d17.exe	WerFault.exe
PID 1152 wrote to memory of 840	1152	012e5ef35e2f13676d6141ea12f8ad4659d8fbdea99c244c995d46e78e5b2d17.exe	WerFault.exe
PID 1152 wrote to memory of 840	1152	012e5ef35e2f13676d6141ea12f8ad4659d8fbdea99c244c995d46e78e5b2d17.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\012e5ef35e2f13676d6141ea12f8ad4659d8fbdea99c244c995d46e78e5b2d17.exe
"C:\Users\Admin\AppData\Local\Temp\012e5ef35e2f13676d6141ea12f8ad4659d8fbdea99c244c995d46e78e5b2d17.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 804
2⤵
- Program crash
PID:840

memory/1152-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1152-1-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1152-2-0x0000000000400000-0x0000000000578000-memory.dmp

Filesize
1.5MB

Download