66d65e525b2ac7ba99ad1e4f7f6178af55e98c5d7f4e6c6e98f42d8fea57ba21

Analysis

max time kernel
2s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:07

Target

66d65e525b2ac7ba99ad1e4f7f6178af55e98c5d7f4e6c6e98f42d8fea57ba21.exe
Size

28KB
MD5

d129f860b81df35e5f18a4211b0fa50b
SHA1

5afe7d0eeede833821782340014a1c1620eced8a
SHA256

66d65e525b2ac7ba99ad1e4f7f6178af55e98c5d7f4e6c6e98f42d8fea57ba21
SHA512

7bc64be2d906769c38045a8b9314489fb54ba3db1245e3dd494a41cb6301ce0aeb5c11382b72391fb7ae1026fcd9d44096adff0570ad6b97970ddeff39a463c1
SSDEEP

384:udciobH4JwqLmI8orPA0PvxeEoxec5xsA93gineBWt9vvA5iOt:YBobHWwq1lc0HPsV93gCeBY9vvA8Ot

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2036 820 WerFault.exe 66d65e525b2ac7ba99ad1e4f7f6178af55e98c5d7f4e6c6e98f42d8fea57ba21.exe

pid	pid_target	process	target process
2036	820	WerFault.exe	66d65e525b2ac7ba99ad1e4f7f6178af55e98c5d7f4e6c6e98f42d8fea57ba21.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

66d65e525b2ac7ba99ad1e4f7f6178af55e98c5d7f4e6c6e98f42d8fea57ba21.exe

description	pid	process	target process
PID 820 wrote to memory of 2036	820	66d65e525b2ac7ba99ad1e4f7f6178af55e98c5d7f4e6c6e98f42d8fea57ba21.exe	WerFault.exe
PID 820 wrote to memory of 2036	820	66d65e525b2ac7ba99ad1e4f7f6178af55e98c5d7f4e6c6e98f42d8fea57ba21.exe	WerFault.exe
PID 820 wrote to memory of 2036	820	66d65e525b2ac7ba99ad1e4f7f6178af55e98c5d7f4e6c6e98f42d8fea57ba21.exe	WerFault.exe
PID 820 wrote to memory of 2036	820	66d65e525b2ac7ba99ad1e4f7f6178af55e98c5d7f4e6c6e98f42d8fea57ba21.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\66d65e525b2ac7ba99ad1e4f7f6178af55e98c5d7f4e6c6e98f42d8fea57ba21.exe
"C:\Users\Admin\AppData\Local\Temp\66d65e525b2ac7ba99ad1e4f7f6178af55e98c5d7f4e6c6e98f42d8fea57ba21.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 820 -s 92
2⤵
- Program crash
PID:2036