0a3457bea87c15936e616cdf30c209420500a7d81b90a956fd3845159a341edf

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-06-2024 07:24

Target

2024-06-22_6cebdf873685cf9273b18cbbad82a872_stop.exe
Size

1.1MB
MD5

6cebdf873685cf9273b18cbbad82a872
SHA1

ba88660773df1a46c98ddfeeb1fb371f39d717bc
SHA256

0a3457bea87c15936e616cdf30c209420500a7d81b90a956fd3845159a341edf
SHA512

b7e067e5556df5fae8d2f695acb736719a2cec9661f63e2d29e5fd88cb5a3283f0e07df0fbc6b5620b404efb35edda90aa9a41157305f40e42847fc52788bb12
SSDEEP

24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/XRPOO8pqHUq7:F0dwAYZt6C31WeTPRPOhpOUq7

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2232 1036 WerFault.exe 2024-06-22_6cebdf873685cf9273b18cbbad82a872_stop.exe

pid	pid_target	process	target process
2232	1036	WerFault.exe	2024-06-22_6cebdf873685cf9273b18cbbad82a872_stop.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-06-22_6cebdf873685cf9273b18cbbad82a872_stop.exe

description	pid	process	target process
PID 1036 wrote to memory of 2232	1036	2024-06-22_6cebdf873685cf9273b18cbbad82a872_stop.exe	WerFault.exe
PID 1036 wrote to memory of 2232	1036	2024-06-22_6cebdf873685cf9273b18cbbad82a872_stop.exe	WerFault.exe
PID 1036 wrote to memory of 2232	1036	2024-06-22_6cebdf873685cf9273b18cbbad82a872_stop.exe	WerFault.exe
PID 1036 wrote to memory of 2232	1036	2024-06-22_6cebdf873685cf9273b18cbbad82a872_stop.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2024-06-22_6cebdf873685cf9273b18cbbad82a872_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-22_6cebdf873685cf9273b18cbbad82a872_stop.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 192
2⤵
- Program crash
PID:2232