0d9fcb8894240750cb5e4222ea78572aba6618eb5297c2069588ceb979d52d8b

Resubmissions

13-07-2024 09:54

13-07-2024 09:52

13-07-2024 09:46

max time kernel
838s
max time network
844s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 09:52

Target

70192d461c98da3d6d9734663dfee8d121b2739e9868f28b1fa67794ba3c9a8b.exe
Size

155KB
MD5

179b38c276e09d3b8a79854ba7232094
SHA1

bc218f468367b4cf127b10a02d2a62f28f35216a
SHA256

70192d461c98da3d6d9734663dfee8d121b2739e9868f28b1fa67794ba3c9a8b
SHA512

367c52c5f8ed2166f3d1e6edf564feefa50f46b8bbdbe1b3ab7007eec02db9d4a806e2f32757ea349a86fded9d4586ff0ae5c8e2403f2ace84083dc05253fad7
SSDEEP

3072:S5K/B0toLQSNJwlxwsx89TSdBgjMqqDL2/TOKyRG:ScytwtLTTSdBgQqqDL6SKN

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2412 2348 WerFault.exe 70192d461c98da3d6d9734663dfee8d121b2739e9868f28b1fa67794ba3c9a8b.exe

pid	pid_target	process	target process
2412	2348	WerFault.exe	70192d461c98da3d6d9734663dfee8d121b2739e9868f28b1fa67794ba3c9a8b.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

70192d461c98da3d6d9734663dfee8d121b2739e9868f28b1fa67794ba3c9a8b.exe

description	pid	process	target process
PID 2348 wrote to memory of 2412	2348	70192d461c98da3d6d9734663dfee8d121b2739e9868f28b1fa67794ba3c9a8b.exe	WerFault.exe
PID 2348 wrote to memory of 2412	2348	70192d461c98da3d6d9734663dfee8d121b2739e9868f28b1fa67794ba3c9a8b.exe	WerFault.exe
PID 2348 wrote to memory of 2412	2348	70192d461c98da3d6d9734663dfee8d121b2739e9868f28b1fa67794ba3c9a8b.exe	WerFault.exe
PID 2348 wrote to memory of 2412	2348	70192d461c98da3d6d9734663dfee8d121b2739e9868f28b1fa67794ba3c9a8b.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\70192d461c98da3d6d9734663dfee8d121b2739e9868f28b1fa67794ba3c9a8b.exe
"C:\Users\Admin\AppData\Local\Temp\70192d461c98da3d6d9734663dfee8d121b2739e9868f28b1fa67794ba3c9a8b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 88
  2⤵
  - Program crash
  PID:2412