2987d440204b186266e7025f49d08c71fdc6228db723e459a9476544d1f22c60

Analysis

max time kernel
37s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:57

Target

2987d440204b186266e7025f49d08c71fdc6228db723e459a9476544d1f22c60.exe
Size

25KB
MD5

f27aec9172a6550b3a80809420592384
SHA1

4f8d083f594835b1c96f27e593e85c8fc018175e
SHA256

2987d440204b186266e7025f49d08c71fdc6228db723e459a9476544d1f22c60
SHA512

0b70e7bd6d70191b3203e71e5a667db5e65cfcf014e9852801913e978985287aa042fa7cec07bc12775c7f9316ad36ac35efb0814f93f9f24ac18c7dbb3615e1
SSDEEP

768:QpZkk7ObzlUGSepJIBzfhojxOJ/RpuedE:QDtObzlUGbIBTujcJ/REedE

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1352 1436 WerFault.exe 2987d440204b186266e7025f49d08c71fdc6228db723e459a9476544d1f22c60.exe

pid	pid_target	process	target process
1352	1436	WerFault.exe	2987d440204b186266e7025f49d08c71fdc6228db723e459a9476544d1f22c60.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2987d440204b186266e7025f49d08c71fdc6228db723e459a9476544d1f22c60.exe

description	pid	process	target process
PID 1436 wrote to memory of 1352	1436	2987d440204b186266e7025f49d08c71fdc6228db723e459a9476544d1f22c60.exe	WerFault.exe
PID 1436 wrote to memory of 1352	1436	2987d440204b186266e7025f49d08c71fdc6228db723e459a9476544d1f22c60.exe	WerFault.exe
PID 1436 wrote to memory of 1352	1436	2987d440204b186266e7025f49d08c71fdc6228db723e459a9476544d1f22c60.exe	WerFault.exe
PID 1436 wrote to memory of 1352	1436	2987d440204b186266e7025f49d08c71fdc6228db723e459a9476544d1f22c60.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2987d440204b186266e7025f49d08c71fdc6228db723e459a9476544d1f22c60.exe
"C:\Users\Admin\AppData\Local\Temp\2987d440204b186266e7025f49d08c71fdc6228db723e459a9476544d1f22c60.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 36
2⤵
- Program crash
PID:1352

memory/1352-54-0x0000000000000000-mapping.dmp

Download
memory/1436-55-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download