7fd91ba887825df7c0d2250e9138cca39cd2f55fff00198f94bace2d03bc97d2

Analysis

max time kernel
26s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:37

Target

7fd91ba887825df7c0d2250e9138cca39cd2f55fff00198f94bace2d03bc97d2.exe
Size

94KB
MD5

454d0f0e17d66dc1cf59866994da36e0
SHA1

a0a1915544fafd569866b05dff00ed64d1b998ba
SHA256

7fd91ba887825df7c0d2250e9138cca39cd2f55fff00198f94bace2d03bc97d2
SHA512

b0d71e7fa140116c4009b3cd608f1919840d13966092a53bb29c2f5fd20f24b7ed732d116e5fa2f0670c0d279d52b797de48d01b3b510f8cb35ee6d3827445b5
SSDEEP

1536:B6umEwkyrXEGMxh9cfXpnO8wxUXZ51Nw30SAM+c8YaEJwZK4/83ZoMOALLbwTc:AumEwLEGMxh9nxUXXNq+hZEXtpxLLbCc

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1356 1476 WerFault.exe 7fd91ba887825df7c0d2250e9138cca39cd2f55fff00198f94bace2d03bc97d2.exe

pid	pid_target	process	target process
1356	1476	WerFault.exe	7fd91ba887825df7c0d2250e9138cca39cd2f55fff00198f94bace2d03bc97d2.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7fd91ba887825df7c0d2250e9138cca39cd2f55fff00198f94bace2d03bc97d2.exe

description	pid	process	target process
PID 1476 wrote to memory of 1356	1476	7fd91ba887825df7c0d2250e9138cca39cd2f55fff00198f94bace2d03bc97d2.exe	WerFault.exe
PID 1476 wrote to memory of 1356	1476	7fd91ba887825df7c0d2250e9138cca39cd2f55fff00198f94bace2d03bc97d2.exe	WerFault.exe
PID 1476 wrote to memory of 1356	1476	7fd91ba887825df7c0d2250e9138cca39cd2f55fff00198f94bace2d03bc97d2.exe	WerFault.exe
PID 1476 wrote to memory of 1356	1476	7fd91ba887825df7c0d2250e9138cca39cd2f55fff00198f94bace2d03bc97d2.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7fd91ba887825df7c0d2250e9138cca39cd2f55fff00198f94bace2d03bc97d2.exe
"C:\Users\Admin\AppData\Local\Temp\7fd91ba887825df7c0d2250e9138cca39cd2f55fff00198f94bace2d03bc97d2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 36
  2⤵
  - Program crash
  PID:1356

memory/1356-54-0x0000000000000000-mapping.dmp

Download
memory/1476-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download