561832e9d4656ba1998aac1c3c45df7bf73d67d0f98474a29d422c63d58feb86

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 13:26

Target

2024-06-13_3020d3a339ca6af904073358744254f1_stop.exe
Size

1.1MB
MD5

3020d3a339ca6af904073358744254f1
SHA1

c93841396e545da2922676c72e117a08cabd0be3
SHA256

561832e9d4656ba1998aac1c3c45df7bf73d67d0f98474a29d422c63d58feb86
SHA512

317baee18813889cf0a9cb2aad4874f44b6d9dc15b5120a1a0c0db62c6a72e9cc3319643493d6f98e61b39e63713e8405a98c6f7aa125c66a3213c9882171898
SSDEEP

24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/XRPOO8N6HUq7:F0dwAYZt6C31WeTPRPOhNeUq7

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2144 2420 WerFault.exe 2024-06-13_3020d3a339ca6af904073358744254f1_stop.exe

pid	pid_target	process	target process
2144	2420	WerFault.exe	2024-06-13_3020d3a339ca6af904073358744254f1_stop.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-06-13_3020d3a339ca6af904073358744254f1_stop.exe

description	pid	process	target process
PID 2420 wrote to memory of 2144	2420	2024-06-13_3020d3a339ca6af904073358744254f1_stop.exe	WerFault.exe
PID 2420 wrote to memory of 2144	2420	2024-06-13_3020d3a339ca6af904073358744254f1_stop.exe	WerFault.exe
PID 2420 wrote to memory of 2144	2420	2024-06-13_3020d3a339ca6af904073358744254f1_stop.exe	WerFault.exe
PID 2420 wrote to memory of 2144	2420	2024-06-13_3020d3a339ca6af904073358744254f1_stop.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2024-06-13_3020d3a339ca6af904073358744254f1_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-13_3020d3a339ca6af904073358744254f1_stop.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 192
2⤵
- Program crash
PID:2144