f6149a4637cd86a5eedc600aedd4c2d141aaae79e8b358e39811091dcfb2c573

Analysis

max time kernel
43s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 02:09

Target

3564-163-0x0000000000400000-0x0000000002C45000-memory.exe
Size

40.3MB
MD5

d9b3c0121611fbac30703df480669dc0
SHA1

67f3716c1ade565fe9356c627c75bfaf2ce60e8c
SHA256

f6149a4637cd86a5eedc600aedd4c2d141aaae79e8b358e39811091dcfb2c573
SHA512

6ee5c421399c55cbce066afd27d63fd286097f7f1acb17d8c068ef62cd70f8b3f560dd7232afb073ab65e9ce1139ebaca9522f250afc0eb3a9f8d9a7c7f2c34f
SSDEEP

6144:t/a2OT8Hn9iwgwwtpbUz6UXY9KDfbQgB:Ja2GoQwgwwIzO9Lo

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

944 1700 WerFault.exe 3564-163-0x0000000000400000-0x0000000002C45000-memory.exe

pid	pid_target	process	target process
944	1700	WerFault.exe	3564-163-0x0000000000400000-0x0000000002C45000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3564-163-0x0000000000400000-0x0000000002C45000-memory.exe

description	pid	process	target process
PID 1700 wrote to memory of 944	1700	3564-163-0x0000000000400000-0x0000000002C45000-memory.exe	WerFault.exe
PID 1700 wrote to memory of 944	1700	3564-163-0x0000000000400000-0x0000000002C45000-memory.exe	WerFault.exe
PID 1700 wrote to memory of 944	1700	3564-163-0x0000000000400000-0x0000000002C45000-memory.exe	WerFault.exe
PID 1700 wrote to memory of 944	1700	3564-163-0x0000000000400000-0x0000000002C45000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3564-163-0x0000000000400000-0x0000000002C45000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\3564-163-0x0000000000400000-0x0000000002C45000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 36
2⤵
- Program crash
PID:944