f101153a23d87d385996a674be8208f543fbc4f4dc1fab1ce17c1ac258b3475a

Analysis

max time kernel
412s
max time network
415s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-10-2022 21:56

Target

f101153a23d87d385996a674be8208f543fbc4f4dc1fab1ce17c1ac258b3475a_unpacked.exe
Size

947KB
MD5

80c4327bad5086548b53ec0165ca42ae
SHA1

5c135002a7bef43de8a97f416cba1156c69fbb37
SHA256

f101153a23d87d385996a674be8208f543fbc4f4dc1fab1ce17c1ac258b3475a
SHA512

449e2dc2abdb1d4504bfcb636398b8e87353be365e412e282da3bf318ab35f798f2e9dd499f4ab3c44681450a1fdcabbdae14064840a60e9b964c60c32b649f1
SSDEEP

12288:YHS7wjY7CErW4sydwCVfsEkJZoz1JcO1TpWFUY0kKR/T710TglEjQyS/Hakc:YAkW11TpwulEkm

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1672 1388 WerFault.exe f101153a23d87d385996a674be8208f543fbc4f4dc1fab1ce17c1ac258b3475a_unpacked.exe

pid	pid_target	process	target process
1672	1388	WerFault.exe	f101153a23d87d385996a674be8208f543fbc4f4dc1fab1ce17c1ac258b3475a_unpacked.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

f101153a23d87d385996a674be8208f543fbc4f4dc1fab1ce17c1ac258b3475a_unpacked.exe

description	pid	process	target process
PID 1388 wrote to memory of 1672	1388	f101153a23d87d385996a674be8208f543fbc4f4dc1fab1ce17c1ac258b3475a_unpacked.exe	WerFault.exe
PID 1388 wrote to memory of 1672	1388	f101153a23d87d385996a674be8208f543fbc4f4dc1fab1ce17c1ac258b3475a_unpacked.exe	WerFault.exe
PID 1388 wrote to memory of 1672	1388	f101153a23d87d385996a674be8208f543fbc4f4dc1fab1ce17c1ac258b3475a_unpacked.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f101153a23d87d385996a674be8208f543fbc4f4dc1fab1ce17c1ac258b3475a_unpacked.exe
"C:\Users\Admin\AppData\Local\Temp\f101153a23d87d385996a674be8208f543fbc4f4dc1fab1ce17c1ac258b3475a_unpacked.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1388 -s 20
2⤵
- Program crash
PID:1672