b19b638ab294f9f8f590d54e31d4d60a2167431ab45edddfcffb6935ba637000

Resubmissions

27-06-2024 18:56

23-06-2024 12:24

23-06-2024 06:23

max time kernel
0s
max time network
0s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 18:56

Target

2024-06-23_a3cae1eca013023abd0f167cb65a44f4_stop.exe
Size

1.1MB
MD5

a3cae1eca013023abd0f167cb65a44f4
SHA1

abd3a58618a26053111a0120362d48f5f965b9da
SHA256

b19b638ab294f9f8f590d54e31d4d60a2167431ab45edddfcffb6935ba637000
SHA512

c6edb242e12f8360fa4eb97898e3acadb735a1601c9d340abb65006c6ff04a234f8e5cf097df8307eb863b8f996be7c7a2eeca243a35e900813426fea4ecc472
SSDEEP

24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/XRPOO8LzHUq7:F0dwAYZt6C31WeTPRPOhLrUq7

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2404 2044 WerFault.exe 2024-06-23_a3cae1eca013023abd0f167cb65a44f4_stop.exe

pid	pid_target	process	target process
2404	2044	WerFault.exe	2024-06-23_a3cae1eca013023abd0f167cb65a44f4_stop.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-06-23_a3cae1eca013023abd0f167cb65a44f4_stop.exe

description	pid	process	target process
PID 2044 wrote to memory of 2404	2044	2024-06-23_a3cae1eca013023abd0f167cb65a44f4_stop.exe	WerFault.exe
PID 2044 wrote to memory of 2404	2044	2024-06-23_a3cae1eca013023abd0f167cb65a44f4_stop.exe	WerFault.exe
PID 2044 wrote to memory of 2404	2044	2024-06-23_a3cae1eca013023abd0f167cb65a44f4_stop.exe	WerFault.exe
PID 2044 wrote to memory of 2404	2044	2024-06-23_a3cae1eca013023abd0f167cb65a44f4_stop.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2024-06-23_a3cae1eca013023abd0f167cb65a44f4_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-23_a3cae1eca013023abd0f167cb65a44f4_stop.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 196
2⤵
- Program crash
PID:2404