0d6494a16aec93bbf79227151adcb085328b2af646f5a65b17a98b7762cd77df

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 11:42

Target

0d6494a16aec93bbf79227151adcb085328b2af646f5a65b17a98b7762cd77df.exe
Size

452KB
MD5

e22eb6b1c1a698104f02bbc8c2dec0dc
SHA1

e87776a3b348d4d465d7e884037a35fccbb45c48
SHA256

0d6494a16aec93bbf79227151adcb085328b2af646f5a65b17a98b7762cd77df
SHA512

b855999b1d90b28525ec3b9119d7542e2f9fc23dbebf9ed187ba56ff37a2f73adec60bbd6dcd3dcfa7eee3eec9a1e9f48068c109aaf1ad1ab7f742b493806000
SSDEEP

6144:Vn9P58Q34DMRyzxvNPWUwXtybWhR05El0iy4rBO5QjXIMOEtsdalxnh7l9DwCPPC:BNt4DMRy3R/EOSINdalxnZl9DlPSEO

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1556 2868 WerFault.exe 0d6494a16aec93bbf79227151adcb085328b2af646f5a65b17a98b7762cd77df.exe

pid	pid_target	process	target process
1556	2868	WerFault.exe	0d6494a16aec93bbf79227151adcb085328b2af646f5a65b17a98b7762cd77df.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0d6494a16aec93bbf79227151adcb085328b2af646f5a65b17a98b7762cd77df.exe

description	pid	process	target process
PID 2868 wrote to memory of 1556	2868	0d6494a16aec93bbf79227151adcb085328b2af646f5a65b17a98b7762cd77df.exe	WerFault.exe
PID 2868 wrote to memory of 1556	2868	0d6494a16aec93bbf79227151adcb085328b2af646f5a65b17a98b7762cd77df.exe	WerFault.exe
PID 2868 wrote to memory of 1556	2868	0d6494a16aec93bbf79227151adcb085328b2af646f5a65b17a98b7762cd77df.exe	WerFault.exe
PID 2868 wrote to memory of 1556	2868	0d6494a16aec93bbf79227151adcb085328b2af646f5a65b17a98b7762cd77df.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0d6494a16aec93bbf79227151adcb085328b2af646f5a65b17a98b7762cd77df.exe
"C:\Users\Admin\AppData\Local\Temp\0d6494a16aec93bbf79227151adcb085328b2af646f5a65b17a98b7762cd77df.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 68
2⤵
- Program crash
PID:1556

memory/2868-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download