0c9d401e9b393d2e7e2e3c727ba6e3e83cde22df260731879a4e5b0350929574

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 15:11

Target

0c9d401e9b393d2e7e2e3c727ba6e3e83cde22df260731879a4e5b0350929574.exe
Size

355KB
MD5

d79b788762c6435ae9f599743f9f482d
SHA1

4d96933a654c426776b30b57b49227e812b3d231
SHA256

0c9d401e9b393d2e7e2e3c727ba6e3e83cde22df260731879a4e5b0350929574
SHA512

e6e3a3be1c171b38a9b167291d2f875c169c04b0aefe7425092301cdb694c2c052fdc30e770634634c82ca3cca76507e20d0aff1ea6db9076299e10935bb39f9
SSDEEP

6144:hKrTm/Wop3oiUklM540oF1zTuoZxFrI/l2k9Joup1JgHEa23sw6ac:8rTm/WohfdFNhhGpIOcYc

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2104 2820 WerFault.exe 0c9d401e9b393d2e7e2e3c727ba6e3e83cde22df260731879a4e5b0350929574.exe

pid	pid_target	process	target process
2104	2820	WerFault.exe	0c9d401e9b393d2e7e2e3c727ba6e3e83cde22df260731879a4e5b0350929574.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0c9d401e9b393d2e7e2e3c727ba6e3e83cde22df260731879a4e5b0350929574.exe

description	pid	process	target process
PID 2820 wrote to memory of 2104	2820	0c9d401e9b393d2e7e2e3c727ba6e3e83cde22df260731879a4e5b0350929574.exe	WerFault.exe
PID 2820 wrote to memory of 2104	2820	0c9d401e9b393d2e7e2e3c727ba6e3e83cde22df260731879a4e5b0350929574.exe	WerFault.exe
PID 2820 wrote to memory of 2104	2820	0c9d401e9b393d2e7e2e3c727ba6e3e83cde22df260731879a4e5b0350929574.exe	WerFault.exe
PID 2820 wrote to memory of 2104	2820	0c9d401e9b393d2e7e2e3c727ba6e3e83cde22df260731879a4e5b0350929574.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0c9d401e9b393d2e7e2e3c727ba6e3e83cde22df260731879a4e5b0350929574.exe
"C:\Users\Admin\AppData\Local\Temp\0c9d401e9b393d2e7e2e3c727ba6e3e83cde22df260731879a4e5b0350929574.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 48
2⤵
- Program crash
PID:2104

memory/2820-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2820-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download