4053416ba4cae0fac8011f9d9e31904159216401b7411aa9219f2847adfd3254

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 09:43

Target

2024-06-03_e9c31bb6f910e7163ba5a4067b3e0577_stop.exe
Size

1.1MB
MD5

e9c31bb6f910e7163ba5a4067b3e0577
SHA1

8d212b54eb62ddc9e935c863f097f92e26381c51
SHA256

4053416ba4cae0fac8011f9d9e31904159216401b7411aa9219f2847adfd3254
SHA512

b432ee7f542dad474a90f4899d9db8e0ac03793a2de33dc09bd8fa19893d74da4208ead3c9b9f94b9a1683ae38789b19de875bf4e9f50144376b97bae056d7d1
SSDEEP

24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/XRPOO8F6HUq7:F0dwAYZt6C31WeTPRPOhFeUq7

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2228 3056 WerFault.exe 2024-06-03_e9c31bb6f910e7163ba5a4067b3e0577_stop.exe

pid	pid_target	process	target process
2228	3056	WerFault.exe	2024-06-03_e9c31bb6f910e7163ba5a4067b3e0577_stop.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-06-03_e9c31bb6f910e7163ba5a4067b3e0577_stop.exe

description	pid	process	target process
PID 3056 wrote to memory of 2228	3056	2024-06-03_e9c31bb6f910e7163ba5a4067b3e0577_stop.exe	WerFault.exe
PID 3056 wrote to memory of 2228	3056	2024-06-03_e9c31bb6f910e7163ba5a4067b3e0577_stop.exe	WerFault.exe
PID 3056 wrote to memory of 2228	3056	2024-06-03_e9c31bb6f910e7163ba5a4067b3e0577_stop.exe	WerFault.exe
PID 3056 wrote to memory of 2228	3056	2024-06-03_e9c31bb6f910e7163ba5a4067b3e0577_stop.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2024-06-03_e9c31bb6f910e7163ba5a4067b3e0577_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_e9c31bb6f910e7163ba5a4067b3e0577_stop.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 192
2⤵
- Program crash
PID:2228