a84206b2fbf0f886f31c182862d44669088204ab98899d8a0268dcef2b217831

Analysis

max time kernel
5s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09-11-2022 14:53

Target

3564-138-0x0000000000400000-0x000000000042F000-memory.exe
Size

188KB
MD5

2607a1f5296cc6b7e670290082c12bc3
SHA1

4bd68a89dedc2dd00969b52d8aa82fdb2cf63cbe
SHA256

a84206b2fbf0f886f31c182862d44669088204ab98899d8a0268dcef2b217831
SHA512

9db8edfefe44e69c94e28cf19e1ba4f523f5f7553453879eaf18e7bc1c57df8e30c917e7f20bec330638aca1381b80f86f3a0b9ade25ee6576f95a677404e17d
SSDEEP

3072:EoOa2gcT52J9euYtWAoibo/0jECmsAKtdSrnOQy4BF8teVEvCQRCALtcx/:EocsreuYVE8oCAWSrnOQfBF8teVEvvR

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

988 1732 WerFault.exe 3564-138-0x0000000000400000-0x000000000042F000-memory.exe

pid	pid_target	process	target process
988	1732	WerFault.exe	3564-138-0x0000000000400000-0x000000000042F000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3564-138-0x0000000000400000-0x000000000042F000-memory.exe

description	pid	process	target process
PID 1732 wrote to memory of 988	1732	3564-138-0x0000000000400000-0x000000000042F000-memory.exe	WerFault.exe
PID 1732 wrote to memory of 988	1732	3564-138-0x0000000000400000-0x000000000042F000-memory.exe	WerFault.exe
PID 1732 wrote to memory of 988	1732	3564-138-0x0000000000400000-0x000000000042F000-memory.exe	WerFault.exe
PID 1732 wrote to memory of 988	1732	3564-138-0x0000000000400000-0x000000000042F000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3564-138-0x0000000000400000-0x000000000042F000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\3564-138-0x0000000000400000-0x000000000042F000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 36
2⤵
- Program crash
PID:988