6163b88851c4f1e15d8386d72795c9b9569033d51c0c5ba9c8033dd7c5f22504

Analysis

max time kernel
38s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-11-2022 01:13

Target

1760-338-0x0000000000400000-0x0000000002C4B000-memory.exe
Size

3.5MB
MD5

8ae9847391a8fd03777fecd0458b45ff
SHA1

8ba4fa38f1e09c99cf0b38fcd61c886a82b77731
SHA256

6163b88851c4f1e15d8386d72795c9b9569033d51c0c5ba9c8033dd7c5f22504
SHA512

d8463c601c90582dc3e3995e86cc31acd0e2681b01fb33c9766795a1575fac55ab88c61be5018c491591d36723d90b28611245a6fb2d85732697616a89361afc
SSDEEP

3072:tQ0sVR/JuxnXFPnGsMl6uApNi4o0/nioNgVlTwk7sG024cQpdUAUXv6UqaY9KDRB:t/a2OT8Hn9iwgwwqpbUz6UXY9KDmJq

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1644 1672 WerFault.exe 1760-338-0x0000000000400000-0x0000000002C4B000-memory.exe

pid	pid_target	process	target process
1644	1672	WerFault.exe	1760-338-0x0000000000400000-0x0000000002C4B000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1760-338-0x0000000000400000-0x0000000002C4B000-memory.exe

description	pid	process	target process
PID 1672 wrote to memory of 1644	1672	1760-338-0x0000000000400000-0x0000000002C4B000-memory.exe	WerFault.exe
PID 1672 wrote to memory of 1644	1672	1760-338-0x0000000000400000-0x0000000002C4B000-memory.exe	WerFault.exe
PID 1672 wrote to memory of 1644	1672	1760-338-0x0000000000400000-0x0000000002C4B000-memory.exe	WerFault.exe
PID 1672 wrote to memory of 1644	1672	1760-338-0x0000000000400000-0x0000000002C4B000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1760-338-0x0000000000400000-0x0000000002C4B000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1760-338-0x0000000000400000-0x0000000002C4B000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 36
2⤵
- Program crash
PID:1644