c2a5a665a4353dc4fb4a800a3bbbaa31f1f46b9803d686c9e5f5eefef55e6720

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 16:13

Target

1504-58-0x0000000000400000-0x0000000002C4B000-memory.exe
Size

40.3MB
MD5

8977163471ec0241bc35e1c109dfcfea
SHA1

99eb32328cf404aae3716af2156a3bfea3ba0b1b
SHA256

c2a5a665a4353dc4fb4a800a3bbbaa31f1f46b9803d686c9e5f5eefef55e6720
SHA512

c490f7df9aabb8ba3ff3127dede4fb88467913ae9ebc130de56d77ab5e87807e49136038a56e6a3b6aa497ddbcf5e5ded0a42a586a56c5c3b1235fd816caaff4
SSDEEP

6144:t/a2OT8Hn9iwgwwJpbUz6UXY9KDfxcAJYe:Ja2GoQwgwwszO9F0Ye

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1260 1632 WerFault.exe 1504-58-0x0000000000400000-0x0000000002C4B000-memory.exe

pid	pid_target	process	target process
1260	1632	WerFault.exe	1504-58-0x0000000000400000-0x0000000002C4B000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1504-58-0x0000000000400000-0x0000000002C4B000-memory.exe

description	pid	process	target process
PID 1632 wrote to memory of 1260	1632	1504-58-0x0000000000400000-0x0000000002C4B000-memory.exe	WerFault.exe
PID 1632 wrote to memory of 1260	1632	1504-58-0x0000000000400000-0x0000000002C4B000-memory.exe	WerFault.exe
PID 1632 wrote to memory of 1260	1632	1504-58-0x0000000000400000-0x0000000002C4B000-memory.exe	WerFault.exe
PID 1632 wrote to memory of 1260	1632	1504-58-0x0000000000400000-0x0000000002C4B000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1504-58-0x0000000000400000-0x0000000002C4B000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1504-58-0x0000000000400000-0x0000000002C4B000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 36
2⤵
- Program crash
PID:1260