bfc092b384976e97153bae0e29359461bfd65fce5ad8188d6460de57bc680eaf

Analysis

max time kernel
15s
max time network
20s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 08:50

Target

1/0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791.exe
Size

389KB
MD5

35a50d146a389289bf8cf8ae60c9e785
SHA1

eb94502d25789eb86dc160c2bc9be4b4a64131bd
SHA256

0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791
SHA512

9bfe09f5165fd43579d87f229ba4a17cc8af8d7fc50ed629de3ec93e1b8d94d9c6aac17f7a429b401f332623cef2178f0d0f1930b674cf1061d24225e5427ada
SSDEEP

6144:blwLkykiFkeLnCUcx/IcoN6OpMW6rTBwEBKI7MUYbuYg785zg2di8DEO:bRiFHnC5m2TB+I70678dXi8DEO

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2368 1768 WerFault.exe 0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791.exe

pid	pid_target	process	target process
2368	1768	WerFault.exe	0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791.exe

description	pid	process	target process
PID 1768 wrote to memory of 2368	1768	0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791.exe	WerFault.exe
PID 1768 wrote to memory of 2368	1768	0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791.exe	WerFault.exe
PID 1768 wrote to memory of 2368	1768	0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791.exe	WerFault.exe
PID 1768 wrote to memory of 2368	1768	0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1\0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791.exe
"C:\Users\Admin\AppData\Local\Temp\1\0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 108
  2⤵
  - Program crash
  PID:2368

memory/1768-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download