350eb9cebd41904262f90589752880b8bcb20de3772417e7949773b5057b072b

Analysis

max time kernel
12s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:48

Target

350eb9cebd41904262f90589752880b8bcb20de3772417e7949773b5057b072b.exe
Size

25KB
MD5

bacc4c3c18ed656e751bd9997e3c7659
SHA1

10f78858ab0619f4be80ab9947c91d0bb0de038f
SHA256

350eb9cebd41904262f90589752880b8bcb20de3772417e7949773b5057b072b
SHA512

74b4d47013ac6a82a72c2a61d1aca366dd8970ff508c467f264a9e05478caf065b585fd0b48235a61d4552396502045d97836f14dad1a5d3395a6ac1b8af705b
SSDEEP

384:jF9mLx2JAoZU9QHnws62qijVGjG/gje/jjGjjj/2jjej/G/eeGjjeGGGkBKIk70X:TmLOU9QHnwsj20AzYcHeIm

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1964 1996 WerFault.exe 350eb9cebd41904262f90589752880b8bcb20de3772417e7949773b5057b072b.exe

pid	pid_target	process	target process
1964	1996	WerFault.exe	350eb9cebd41904262f90589752880b8bcb20de3772417e7949773b5057b072b.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

350eb9cebd41904262f90589752880b8bcb20de3772417e7949773b5057b072b.exe

description	pid	process	target process
PID 1996 wrote to memory of 1964	1996	350eb9cebd41904262f90589752880b8bcb20de3772417e7949773b5057b072b.exe	WerFault.exe
PID 1996 wrote to memory of 1964	1996	350eb9cebd41904262f90589752880b8bcb20de3772417e7949773b5057b072b.exe	WerFault.exe
PID 1996 wrote to memory of 1964	1996	350eb9cebd41904262f90589752880b8bcb20de3772417e7949773b5057b072b.exe	WerFault.exe
PID 1996 wrote to memory of 1964	1996	350eb9cebd41904262f90589752880b8bcb20de3772417e7949773b5057b072b.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\350eb9cebd41904262f90589752880b8bcb20de3772417e7949773b5057b072b.exe
"C:\Users\Admin\AppData\Local\Temp\350eb9cebd41904262f90589752880b8bcb20de3772417e7949773b5057b072b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 536
2⤵
- Program crash
PID:1964

memory/1964-55-0x0000000000000000-mapping.dmp

Download
memory/1996-54-0x0000000000D10000-0x0000000000D1C000-memory.dmp

Filesize
48KB

Download