6d1fb9164210bca32b02a505a64f25525ede95b4985a4a3a7a1ca75c429cde3d

Analysis

max time kernel
71s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:07

Target

6d1fb9164210bca32b02a505a64f25525ede95b4985a4a3a7a1ca75c429cde3d.exe
Size

28KB
MD5

9b229a5380860be57fe20cc1f2071730
SHA1

bb6abff149e1c5b23fd15537983161c07015f56a
SHA256

6d1fb9164210bca32b02a505a64f25525ede95b4985a4a3a7a1ca75c429cde3d
SHA512

f54fa5f5d0dc443d72b26a29d37fb3e6f5d7fa1388ffc6cf63814c94c11109e03389f735a7ee64eafc02ba3310cc2fb5e4d4651208e26ba61dc0c0388c8ed8cf
SSDEEP

384:udciobH4JwqLmI8orPA0PvxeEoxec5xsA93gineBWt9vvA5pOt:YBobHWwq1lc0HPsV93gCeBY9vvAvOt

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

432 900 WerFault.exe 6d1fb9164210bca32b02a505a64f25525ede95b4985a4a3a7a1ca75c429cde3d.exe

pid	pid_target	process	target process
432	900	WerFault.exe	6d1fb9164210bca32b02a505a64f25525ede95b4985a4a3a7a1ca75c429cde3d.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6d1fb9164210bca32b02a505a64f25525ede95b4985a4a3a7a1ca75c429cde3d.exe

description	pid	process	target process
PID 900 wrote to memory of 432	900	6d1fb9164210bca32b02a505a64f25525ede95b4985a4a3a7a1ca75c429cde3d.exe	WerFault.exe
PID 900 wrote to memory of 432	900	6d1fb9164210bca32b02a505a64f25525ede95b4985a4a3a7a1ca75c429cde3d.exe	WerFault.exe
PID 900 wrote to memory of 432	900	6d1fb9164210bca32b02a505a64f25525ede95b4985a4a3a7a1ca75c429cde3d.exe	WerFault.exe
PID 900 wrote to memory of 432	900	6d1fb9164210bca32b02a505a64f25525ede95b4985a4a3a7a1ca75c429cde3d.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6d1fb9164210bca32b02a505a64f25525ede95b4985a4a3a7a1ca75c429cde3d.exe
"C:\Users\Admin\AppData\Local\Temp\6d1fb9164210bca32b02a505a64f25525ede95b4985a4a3a7a1ca75c429cde3d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 92
2⤵
- Program crash
PID:432