e566ee2189f830504af1cb787279111b7b2f3817a61a85bad8d9810701dd4877

Analysis

max time kernel
1443s
max time network
1450s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 08:54

Target

10dc6e128c7e5e7088f487ba9b22c1a836f50a552bc93fcce748d7e1c8f76fc0.exe
Size

155KB
MD5

cd7be52f7de09e277fc532a3b7006ec7
SHA1

ed9a3809734da6769abd52bdc7c83aa210522adf
SHA256

10dc6e128c7e5e7088f487ba9b22c1a836f50a552bc93fcce748d7e1c8f76fc0
SHA512

b0560990fbca4e7747c44b07ff509c1a942425b4f38ee32e87a5e7a3c8862220bd0c5192defadd66fb0e812d64a05e6f2f332df72dc5c786b95738383c364ccf
SSDEEP

3072:l5K/B0toLwSNJ5lZHQsozTS+SMqqDL2/TrKDtG:lcytwNr1yTS+xqqDL6HKE

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2456 1932 WerFault.exe 10dc6e128c7e5e7088f487ba9b22c1a836f50a552bc93fcce748d7e1c8f76fc0.exe

pid	pid_target	process	target process
2456	1932	WerFault.exe	10dc6e128c7e5e7088f487ba9b22c1a836f50a552bc93fcce748d7e1c8f76fc0.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

10dc6e128c7e5e7088f487ba9b22c1a836f50a552bc93fcce748d7e1c8f76fc0.exe

description	pid	process	target process
PID 1932 wrote to memory of 2456	1932	10dc6e128c7e5e7088f487ba9b22c1a836f50a552bc93fcce748d7e1c8f76fc0.exe	WerFault.exe
PID 1932 wrote to memory of 2456	1932	10dc6e128c7e5e7088f487ba9b22c1a836f50a552bc93fcce748d7e1c8f76fc0.exe	WerFault.exe
PID 1932 wrote to memory of 2456	1932	10dc6e128c7e5e7088f487ba9b22c1a836f50a552bc93fcce748d7e1c8f76fc0.exe	WerFault.exe
PID 1932 wrote to memory of 2456	1932	10dc6e128c7e5e7088f487ba9b22c1a836f50a552bc93fcce748d7e1c8f76fc0.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\10dc6e128c7e5e7088f487ba9b22c1a836f50a552bc93fcce748d7e1c8f76fc0.exe
"C:\Users\Admin\AppData\Local\Temp\10dc6e128c7e5e7088f487ba9b22c1a836f50a552bc93fcce748d7e1c8f76fc0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 88
  2⤵
  - Program crash
  PID:2456