f4ad3e8771e1def13ed269118c7e220a96400895491aad8550d0083af1f52193

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 17:27

Target

2024-05-31_df64affde29da1d0ca7c601d71d32248_stop.exe
Size

1.1MB
MD5

df64affde29da1d0ca7c601d71d32248
SHA1

320fa10cd9fda2c3630c05b93524a3ba29e94b9c
SHA256

f4ad3e8771e1def13ed269118c7e220a96400895491aad8550d0083af1f52193
SHA512

4bd2447839826a21ba19a67dc15b8551254ef7eb7bdf494266d638df620ad1ea922f1e60d2cd3fce45485b483e893333f66c2deb585d4aa9ee9f4506e58fcc90
SSDEEP

24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/VRPOO8KeHUq7:F0dwAYZt6C31WeT9RPOhKKUq7

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2192 2208 WerFault.exe 2024-05-31_df64affde29da1d0ca7c601d71d32248_stop.exe

pid	pid_target	process	target process
2192	2208	WerFault.exe	2024-05-31_df64affde29da1d0ca7c601d71d32248_stop.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-31_df64affde29da1d0ca7c601d71d32248_stop.exe

description	pid	process	target process
PID 2208 wrote to memory of 2192	2208	2024-05-31_df64affde29da1d0ca7c601d71d32248_stop.exe	WerFault.exe
PID 2208 wrote to memory of 2192	2208	2024-05-31_df64affde29da1d0ca7c601d71d32248_stop.exe	WerFault.exe
PID 2208 wrote to memory of 2192	2208	2024-05-31_df64affde29da1d0ca7c601d71d32248_stop.exe	WerFault.exe
PID 2208 wrote to memory of 2192	2208	2024-05-31_df64affde29da1d0ca7c601d71d32248_stop.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-31_df64affde29da1d0ca7c601d71d32248_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-31_df64affde29da1d0ca7c601d71d32248_stop.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 192
2⤵
- Program crash
PID:2192