fb979976c41b0cd99b4b62fb319ec9e08b57dc865a90e858c90259cdd3413c30

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 19:54

Target

fb979976c41b0cd99b4b62fb319ec9e08b57dc865a90e858c90259cdd3413c30.exe
Size

349KB
MD5

b3de9ac3741d8503b9886d7f6c9ee12e
SHA1

950b740f736291fb013c4f7efcd2618cde0cb348
SHA256

fb979976c41b0cd99b4b62fb319ec9e08b57dc865a90e858c90259cdd3413c30
SHA512

0a59657f2d6860927a26ef882f9a3182320c8b863b65d5bd4582fec3607b14ed2ad2cfd9d856e97eb2ae05ce4ca01cbe8e5f4cc0eb568d127d1411ed74c86c57
SSDEEP

6144:q+jfY43T97LdTJQnzkr5meQzK0uY5C0kfHaYyJv5xma2L6yYUPyBt0T9az:q+jffT97L9JQnzkr5meQzK0uuC0kSnLJ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3004 1148 WerFault.exe fb979976c41b0cd99b4b62fb319ec9e08b57dc865a90e858c90259cdd3413c30.exe

pid	pid_target	process	target process
3004	1148	WerFault.exe	fb979976c41b0cd99b4b62fb319ec9e08b57dc865a90e858c90259cdd3413c30.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fb979976c41b0cd99b4b62fb319ec9e08b57dc865a90e858c90259cdd3413c30.exe

description	pid	process	target process
PID 1148 wrote to memory of 3004	1148	fb979976c41b0cd99b4b62fb319ec9e08b57dc865a90e858c90259cdd3413c30.exe	WerFault.exe
PID 1148 wrote to memory of 3004	1148	fb979976c41b0cd99b4b62fb319ec9e08b57dc865a90e858c90259cdd3413c30.exe	WerFault.exe
PID 1148 wrote to memory of 3004	1148	fb979976c41b0cd99b4b62fb319ec9e08b57dc865a90e858c90259cdd3413c30.exe	WerFault.exe
PID 1148 wrote to memory of 3004	1148	fb979976c41b0cd99b4b62fb319ec9e08b57dc865a90e858c90259cdd3413c30.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fb979976c41b0cd99b4b62fb319ec9e08b57dc865a90e858c90259cdd3413c30.exe
"C:\Users\Admin\AppData\Local\Temp\fb979976c41b0cd99b4b62fb319ec9e08b57dc865a90e858c90259cdd3413c30.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 48
2⤵
- Program crash
PID:3004