fba348029727ad389484d220941eefd8ced7783b77326e27d407d2c13ac39348

Analysis

max time kernel
32s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 07:40

Target

fba348029727ad389484d220941eefd8ced7783b77326e27d407d2c13ac39348.exe
Size

665KB
MD5

9bca65ed2f75f83a094f6e5b2cf6c2b8
SHA1

0cc2faed9c017cc75f76bb18a3ca07f78e183d0b
SHA256

fba348029727ad389484d220941eefd8ced7783b77326e27d407d2c13ac39348
SHA512

8a30f607ab9b2f9859c01083a5a1930cb5499fad9f0641a5dc654712674112bd11213b5c327c17def665af06dfc7d97367916b2ca8f5e3c1b803b70adef8b58c
SSDEEP

12288:bI4Cld3+qJS3YdaHK6pY3hvolspYZj/ZjOO4:bI5uqJSI8q130sYZ7ZjOO4

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

936 1460 WerFault.exe fba348029727ad389484d220941eefd8ced7783b77326e27d407d2c13ac39348.exe

pid	pid_target	process	target process
936	1460	WerFault.exe	fba348029727ad389484d220941eefd8ced7783b77326e27d407d2c13ac39348.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fba348029727ad389484d220941eefd8ced7783b77326e27d407d2c13ac39348.exe

description	pid	process	target process
PID 1460 wrote to memory of 936	1460	fba348029727ad389484d220941eefd8ced7783b77326e27d407d2c13ac39348.exe	WerFault.exe
PID 1460 wrote to memory of 936	1460	fba348029727ad389484d220941eefd8ced7783b77326e27d407d2c13ac39348.exe	WerFault.exe
PID 1460 wrote to memory of 936	1460	fba348029727ad389484d220941eefd8ced7783b77326e27d407d2c13ac39348.exe	WerFault.exe
PID 1460 wrote to memory of 936	1460	fba348029727ad389484d220941eefd8ced7783b77326e27d407d2c13ac39348.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fba348029727ad389484d220941eefd8ced7783b77326e27d407d2c13ac39348.exe
"C:\Users\Admin\AppData\Local\Temp\fba348029727ad389484d220941eefd8ced7783b77326e27d407d2c13ac39348.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 656
2⤵
- Program crash
PID:936

memory/936-56-0x0000000000000000-mapping.dmp

Download
memory/1460-54-0x0000000000F50000-0x0000000000FFC000-memory.dmp

Filesize
688KB

Download
memory/1460-55-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download