7000d90861bb4d3877c1b4d8934eca5dd3f4ec0381c3c7579b8ee727bf058af7

Analysis

max time kernel
10s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:41

Target

7000d90861bb4d3877c1b4d8934eca5dd3f4ec0381c3c7579b8ee727bf058af7.exe
Size

12KB
MD5

22b4128006fb918c06c061de57fe7aa8
SHA1

689d7017e692d97e550d37c7ffcf27e827673ca9
SHA256

7000d90861bb4d3877c1b4d8934eca5dd3f4ec0381c3c7579b8ee727bf058af7
SHA512

eda82a573b289672778784cda884283ffee482c467b97845f4c3d3c67bec70b5bafb7b1f914615f586d40dcffa7933ae0b1424702b3aca2191941cc391dccc56
SSDEEP

192:NlgxaFWDK24VTAVXvK6DYV+woc24x+qXl86yLWK2V3uFo33IxAokLUlwgGT08yyF:Nlg4FWb4V0Vs24+qV86yboH3w6jegOu

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2012 1676 WerFault.exe 7000d90861bb4d3877c1b4d8934eca5dd3f4ec0381c3c7579b8ee727bf058af7.exe

pid	pid_target	process	target process
2012	1676	WerFault.exe	7000d90861bb4d3877c1b4d8934eca5dd3f4ec0381c3c7579b8ee727bf058af7.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7000d90861bb4d3877c1b4d8934eca5dd3f4ec0381c3c7579b8ee727bf058af7.exe

description	pid	process	target process
PID 1676 wrote to memory of 2012	1676	7000d90861bb4d3877c1b4d8934eca5dd3f4ec0381c3c7579b8ee727bf058af7.exe	WerFault.exe
PID 1676 wrote to memory of 2012	1676	7000d90861bb4d3877c1b4d8934eca5dd3f4ec0381c3c7579b8ee727bf058af7.exe	WerFault.exe
PID 1676 wrote to memory of 2012	1676	7000d90861bb4d3877c1b4d8934eca5dd3f4ec0381c3c7579b8ee727bf058af7.exe	WerFault.exe
PID 1676 wrote to memory of 2012	1676	7000d90861bb4d3877c1b4d8934eca5dd3f4ec0381c3c7579b8ee727bf058af7.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7000d90861bb4d3877c1b4d8934eca5dd3f4ec0381c3c7579b8ee727bf058af7.exe
"C:\Users\Admin\AppData\Local\Temp\7000d90861bb4d3877c1b4d8934eca5dd3f4ec0381c3c7579b8ee727bf058af7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 100
2⤵
- Program crash
PID:2012

memory/1676-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2012-54-0x0000000000000000-mapping.dmp

Download