42f7ec36e07bca91cfa99c9b5a1643a7674e4af4c93905a993eab902e0bfa70d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 07:52

Target

42f7ec36e07bca91cfa99c9b5a1643a7674e4af4c93905a993eab902e0bfa70d.exe
Size

355KB
MD5

8a848d90a8d7a8c79b80d2dd8d330d9d
SHA1

6694c6e16123598f1665b7c68da40fd342e683fa
SHA256

42f7ec36e07bca91cfa99c9b5a1643a7674e4af4c93905a993eab902e0bfa70d
SHA512

d67683611a368964d4dbc2ed85c9c458e5502cc8fb50608ef184cdb574e55636f800c471f8224b1fe82874175f9802d07a8dacdac5eeb73bd72a35bb7b71d54e
SSDEEP

6144:FHAqyjjclaS6sR38CS0iD7RjPyvB7m2Rx6PLfciHid4Fwem:JAqyjjmK06ByZ7m2yee

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2792 1888 WerFault.exe 42f7ec36e07bca91cfa99c9b5a1643a7674e4af4c93905a993eab902e0bfa70d.exe

pid	pid_target	process	target process
2792	1888	WerFault.exe	42f7ec36e07bca91cfa99c9b5a1643a7674e4af4c93905a993eab902e0bfa70d.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

42f7ec36e07bca91cfa99c9b5a1643a7674e4af4c93905a993eab902e0bfa70d.exe

description	pid	process	target process
PID 1888 wrote to memory of 2792	1888	42f7ec36e07bca91cfa99c9b5a1643a7674e4af4c93905a993eab902e0bfa70d.exe	WerFault.exe
PID 1888 wrote to memory of 2792	1888	42f7ec36e07bca91cfa99c9b5a1643a7674e4af4c93905a993eab902e0bfa70d.exe	WerFault.exe
PID 1888 wrote to memory of 2792	1888	42f7ec36e07bca91cfa99c9b5a1643a7674e4af4c93905a993eab902e0bfa70d.exe	WerFault.exe
PID 1888 wrote to memory of 2792	1888	42f7ec36e07bca91cfa99c9b5a1643a7674e4af4c93905a993eab902e0bfa70d.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\42f7ec36e07bca91cfa99c9b5a1643a7674e4af4c93905a993eab902e0bfa70d.exe
"C:\Users\Admin\AppData\Local\Temp\42f7ec36e07bca91cfa99c9b5a1643a7674e4af4c93905a993eab902e0bfa70d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 48
2⤵
- Program crash
PID:2792

memory/1888-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1888-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download