cc65535243dfd3cd54a9c5ecfcb93c7f918a87c725e9c52925017ab92effe278

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 09:29

Target

01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe
Size

155KB
MD5

7e3b2b10d66955465c12da9f2ab43e36
SHA1

2ee3d7ce4ec3461026e910fdfcf9d18dd43eb380
SHA256

01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550
SHA512

ce37aff2e2aba9d6434454e17bafeebc47e9d86a716fcd9732bc03bf6484c4b6428d43322279b9273c3e5386ce924853d3aebf90178b2fa5009d63e1defd47a0
SSDEEP

3072:l5K/B0toLuSNJilZHQsozTS+SMqqDL2/TrKLOG:lcytw7a1yTS+xqqDL6HKL

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2592 2572 WerFault.exe 01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe

pid	pid_target	process	target process
2592	2572	WerFault.exe	01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe

description	pid	process	target process
PID 2572 wrote to memory of 2592	2572	01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe	WerFault.exe
PID 2572 wrote to memory of 2592	2572	01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe	WerFault.exe
PID 2572 wrote to memory of 2592	2572	01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe	WerFault.exe
PID 2572 wrote to memory of 2592	2572	01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe
"C:\Users\Admin\AppData\Local\Temp\01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 88
  2⤵
  - Program crash
  PID:2592