f04cb1b8a8beb6a51b0beb2867d18dc6df2352afb67a3c85233a7383c1ce3617

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 10:57

Target

file.exe
Size

2.9MB
MD5

8eb3c7bc1ad38ae064eda594deed070b
SHA1

58d2d8baa9a14ece4ae12b6cd3260e79c7003059
SHA256

f04cb1b8a8beb6a51b0beb2867d18dc6df2352afb67a3c85233a7383c1ce3617
SHA512

4c86c4e290b678faecf906719c183fe190ce88e7242ae25af35887c12da9e4184010a94854cf12e49342074d56097dc117439f9711600f110222c264fa730648
SSDEEP

49152:U4D5fBZcSZW/ym3NyBWvYPywzniB/U+0DqKwoszSwKWFQpFR7IUyq3QqumQhG/75:U+W/D3gBlmB/URKos9z2pFF/puLc71

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2432 1688 WerFault.exe file.exe

pid	pid_target	process	target process
2432	1688	WerFault.exe	file.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

file.exe

description	pid	process	target process
PID 1688 wrote to memory of 2432	1688	file.exe	WerFault.exe
PID 1688 wrote to memory of 2432	1688	file.exe	WerFault.exe
PID 1688 wrote to memory of 2432	1688	file.exe	WerFault.exe
PID 1688 wrote to memory of 2432	1688	file.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 72
2⤵
- Program crash
PID:2432

memory/1688-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1688-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download