bfc092b384976e97153bae0e29359461bfd65fce5ad8188d6460de57bc680eaf

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 08:50

Target

1/2ef0f582367a7674aef245acb06977bf646419f1f8d05c7fb07881a6102f982e.exe
Size

338KB
MD5

d5ad720fa67bbce2d11544ad3c211424
SHA1

e9f63402b2eaabbdcc6cb5ec95e328f9620cd170
SHA256

2ef0f582367a7674aef245acb06977bf646419f1f8d05c7fb07881a6102f982e
SHA512

d8a8ae60abec80b7cfd7c9b9bc19d2f2594d1ecee0a28cf9a2f545afc7ef0ee59ca7a073edb8415f006662ed2095f9f3c190abed5023b81e094724c04ba153c6
SSDEEP

6144:RY1jkmalKcYdvkMEdRE29UHYOhQWr3y/7qpKfQmhapjXFISRn2di8bEO:RcEKc+kMcI+IKImcFISAi8bEO

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2800 2260 WerFault.exe 2ef0f582367a7674aef245acb06977bf646419f1f8d05c7fb07881a6102f982e.exe

pid	pid_target	process	target process
2800	2260	WerFault.exe	2ef0f582367a7674aef245acb06977bf646419f1f8d05c7fb07881a6102f982e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2ef0f582367a7674aef245acb06977bf646419f1f8d05c7fb07881a6102f982e.exe

description	pid	process	target process
PID 2260 wrote to memory of 2800	2260	2ef0f582367a7674aef245acb06977bf646419f1f8d05c7fb07881a6102f982e.exe	WerFault.exe
PID 2260 wrote to memory of 2800	2260	2ef0f582367a7674aef245acb06977bf646419f1f8d05c7fb07881a6102f982e.exe	WerFault.exe
PID 2260 wrote to memory of 2800	2260	2ef0f582367a7674aef245acb06977bf646419f1f8d05c7fb07881a6102f982e.exe	WerFault.exe
PID 2260 wrote to memory of 2800	2260	2ef0f582367a7674aef245acb06977bf646419f1f8d05c7fb07881a6102f982e.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1\2ef0f582367a7674aef245acb06977bf646419f1f8d05c7fb07881a6102f982e.exe
"C:\Users\Admin\AppData\Local\Temp\1\2ef0f582367a7674aef245acb06977bf646419f1f8d05c7fb07881a6102f982e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 108
  2⤵
  - Program crash
  PID:2800

memory/2260-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download