b43d6fa678ed8e08ae7b0def4ddd1aba13fd977455944d5d0fd7495127f347e6

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 00:49

Target

b43d6fa678ed8e08ae7b0def4ddd1aba13fd977455944d5d0fd7495127f347e6.exe
Size

365KB
MD5

849677f2e87d745e47a539736d1b9024
SHA1

ec13233cc8c1c860570d3eaf0fd6d62c97113942
SHA256

b43d6fa678ed8e08ae7b0def4ddd1aba13fd977455944d5d0fd7495127f347e6
SHA512

a8018b8c184d616d61da148add9a40a8d5be3b2310b9feb416d95d9468e32a36a870eb3bae7223f9fcb52293a2839fa886abe7e924365674e56c569f4ec00d5e
SSDEEP

6144:81R9rz1Q1i9dGeLEcFGE+2u35VHff67UPJzbd:81Rdz1T9RLBpNu35d64/d

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2940 332 WerFault.exe b43d6fa678ed8e08ae7b0def4ddd1aba13fd977455944d5d0fd7495127f347e6.exe

pid	pid_target	process	target process
2940	332	WerFault.exe	b43d6fa678ed8e08ae7b0def4ddd1aba13fd977455944d5d0fd7495127f347e6.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b43d6fa678ed8e08ae7b0def4ddd1aba13fd977455944d5d0fd7495127f347e6.exe

description	pid	process	target process
PID 332 wrote to memory of 2940	332	b43d6fa678ed8e08ae7b0def4ddd1aba13fd977455944d5d0fd7495127f347e6.exe	WerFault.exe
PID 332 wrote to memory of 2940	332	b43d6fa678ed8e08ae7b0def4ddd1aba13fd977455944d5d0fd7495127f347e6.exe	WerFault.exe
PID 332 wrote to memory of 2940	332	b43d6fa678ed8e08ae7b0def4ddd1aba13fd977455944d5d0fd7495127f347e6.exe	WerFault.exe
PID 332 wrote to memory of 2940	332	b43d6fa678ed8e08ae7b0def4ddd1aba13fd977455944d5d0fd7495127f347e6.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\b43d6fa678ed8e08ae7b0def4ddd1aba13fd977455944d5d0fd7495127f347e6.exe
"C:\Users\Admin\AppData\Local\Temp\b43d6fa678ed8e08ae7b0def4ddd1aba13fd977455944d5d0fd7495127f347e6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 332 -s 120
2⤵
- Program crash
PID:2940