fb422513f6d2560a1df152e42bcd9dfffd546b98969a6cdbc9b32a601ada5b72

Analysis

max time kernel
42s
max time network
63s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:32

Target

fb422513f6d2560a1df152e42bcd9dfffd546b98969a6cdbc9b32a601ada5b72.exe
Size

107KB
MD5

525861666f9cf279a785a2c84e2912d0
SHA1

861130eaa57fd289a14db3f7385f3c5f9083f49f
SHA256

fb422513f6d2560a1df152e42bcd9dfffd546b98969a6cdbc9b32a601ada5b72
SHA512

8de25c31db2a772c0198db15aece553c439d3aaf1f60f2ab97c4204fbf661f57764d7a8d4620510caf3f4da4eb9f1a709a9dca70b21fc989ea161b27d9b6a003
SSDEEP

3072:wL+FnPL1wGD23bRSTp6q00llVkHs2quGf9:wL8PL6Y23bc6Eu

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

952 1728 WerFault.exe fb422513f6d2560a1df152e42bcd9dfffd546b98969a6cdbc9b32a601ada5b72.exe

pid	pid_target	process	target process
952	1728	WerFault.exe	fb422513f6d2560a1df152e42bcd9dfffd546b98969a6cdbc9b32a601ada5b72.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fb422513f6d2560a1df152e42bcd9dfffd546b98969a6cdbc9b32a601ada5b72.exe

description	pid	process	target process
PID 1728 wrote to memory of 952	1728	fb422513f6d2560a1df152e42bcd9dfffd546b98969a6cdbc9b32a601ada5b72.exe	WerFault.exe
PID 1728 wrote to memory of 952	1728	fb422513f6d2560a1df152e42bcd9dfffd546b98969a6cdbc9b32a601ada5b72.exe	WerFault.exe
PID 1728 wrote to memory of 952	1728	fb422513f6d2560a1df152e42bcd9dfffd546b98969a6cdbc9b32a601ada5b72.exe	WerFault.exe
PID 1728 wrote to memory of 952	1728	fb422513f6d2560a1df152e42bcd9dfffd546b98969a6cdbc9b32a601ada5b72.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fb422513f6d2560a1df152e42bcd9dfffd546b98969a6cdbc9b32a601ada5b72.exe
"C:\Users\Admin\AppData\Local\Temp\fb422513f6d2560a1df152e42bcd9dfffd546b98969a6cdbc9b32a601ada5b72.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 36
2⤵
- Program crash
PID:952

memory/952-54-0x0000000000000000-mapping.dmp

Download
memory/1728-55-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download