cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 05:08

Target

cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe
Size

507KB
MD5

0f9b8c6500c040df8aee110cac74225a
SHA1

51892cdff9f9afa873c096e372053f669792bb70
SHA256

cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d
SHA512

651a7e9580880ba8ece3d345555f0765ed3ded259d88dd40501ccde326bebc01128c1d3653cda721c7fec3f7091781feb43c7be29ac54d1c1070caae4bd71fa9
SSDEEP

12288:KLo2tQgRiP9bu1ircdlgkXfzYJvNrXWoaVS4SZn:ikOiRzQdRuNLWoaVS4S

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3044 1932 WerFault.exe cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe

pid	pid_target	process	target process
3044	1932	WerFault.exe	cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe

description	pid	process	target process
PID 1932 wrote to memory of 3044	1932	cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe	WerFault.exe
PID 1932 wrote to memory of 3044	1932	cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe	WerFault.exe
PID 1932 wrote to memory of 3044	1932	cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe	WerFault.exe
PID 1932 wrote to memory of 3044	1932	cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe
"C:\Users\Admin\AppData\Local\Temp\cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 96
2⤵
- Program crash
PID:3044

memory/1932-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download