8ff8af7b31fe7ed58b2afc1b556c635c2ccdf20bce7ca371897dea490a8b5027

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 09:29

Target

0bd9556e36c620bbedfafd2e76bb6703f069aa654e34008f2aef3b4a0ce6f874.exe
Size

155KB
MD5

6827dfd481743d41ed35fb36740c0db7
SHA1

a3739fad76445b8e95970a7ae1638b8e7377c99d
SHA256

0bd9556e36c620bbedfafd2e76bb6703f069aa654e34008f2aef3b4a0ce6f874
SHA512

9a149ba007eb8f7b6160f5637d578dcc8b28d3bc36e8cb78d354a96b726431202a8d6230599bf28528cefb9cb2567b0eaf2ded3cfb4cda3a8996166f7a6cd5a4
SSDEEP

3072:l5K/B0toLQSNJ7lZHQsozTS+SMqqDL2/TrK/uG:lcytwtJ1yTS+xqqDL6HKX

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2092 3012 WerFault.exe 0bd9556e36c620bbedfafd2e76bb6703f069aa654e34008f2aef3b4a0ce6f874.exe

pid	pid_target	process	target process
2092	3012	WerFault.exe	0bd9556e36c620bbedfafd2e76bb6703f069aa654e34008f2aef3b4a0ce6f874.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0bd9556e36c620bbedfafd2e76bb6703f069aa654e34008f2aef3b4a0ce6f874.exe

description	pid	process	target process
PID 3012 wrote to memory of 2092	3012	0bd9556e36c620bbedfafd2e76bb6703f069aa654e34008f2aef3b4a0ce6f874.exe	WerFault.exe
PID 3012 wrote to memory of 2092	3012	0bd9556e36c620bbedfafd2e76bb6703f069aa654e34008f2aef3b4a0ce6f874.exe	WerFault.exe
PID 3012 wrote to memory of 2092	3012	0bd9556e36c620bbedfafd2e76bb6703f069aa654e34008f2aef3b4a0ce6f874.exe	WerFault.exe
PID 3012 wrote to memory of 2092	3012	0bd9556e36c620bbedfafd2e76bb6703f069aa654e34008f2aef3b4a0ce6f874.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0bd9556e36c620bbedfafd2e76bb6703f069aa654e34008f2aef3b4a0ce6f874.exe
"C:\Users\Admin\AppData\Local\Temp\0bd9556e36c620bbedfafd2e76bb6703f069aa654e34008f2aef3b4a0ce6f874.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 88
2⤵
- Program crash
PID:2092