58e3ba198cdf68637de2935361095552ed807fb3f66a8b6c6b97a22b9f51685f

Analysis

max time kernel
224s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:16

Target

58e3ba198cdf68637de2935361095552ed807fb3f66a8b6c6b97a22b9f51685f.exe
Size

104KB
MD5

5d470ecb6346504f7b5fb39b4e7f961c
SHA1

eaf4dd89ca9bf1a898d3e6dcabca69abe4291b71
SHA256

58e3ba198cdf68637de2935361095552ed807fb3f66a8b6c6b97a22b9f51685f
SHA512

c2e02297a1c31e0d3fc7800d2fe4fc2e471d4c43e63c87fa0e0ac3debe1854f8a5a6d7bb13c7821275e90f7eae903a7f31eabe136fd7a0005c407997e8f9f36b
SSDEEP

3072:ETQk6JcigUNzel72fkJJA3v2KOaX5KFq:HReigUeB2fkK2KUq

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

892 716 WerFault.exe 58e3ba198cdf68637de2935361095552ed807fb3f66a8b6c6b97a22b9f51685f.exe

pid	pid_target	process	target process
892	716	WerFault.exe	58e3ba198cdf68637de2935361095552ed807fb3f66a8b6c6b97a22b9f51685f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

58e3ba198cdf68637de2935361095552ed807fb3f66a8b6c6b97a22b9f51685f.exe

description	pid	process	target process
PID 716 wrote to memory of 892	716	58e3ba198cdf68637de2935361095552ed807fb3f66a8b6c6b97a22b9f51685f.exe	WerFault.exe
PID 716 wrote to memory of 892	716	58e3ba198cdf68637de2935361095552ed807fb3f66a8b6c6b97a22b9f51685f.exe	WerFault.exe
PID 716 wrote to memory of 892	716	58e3ba198cdf68637de2935361095552ed807fb3f66a8b6c6b97a22b9f51685f.exe	WerFault.exe
PID 716 wrote to memory of 892	716	58e3ba198cdf68637de2935361095552ed807fb3f66a8b6c6b97a22b9f51685f.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\58e3ba198cdf68637de2935361095552ed807fb3f66a8b6c6b97a22b9f51685f.exe
"C:\Users\Admin\AppData\Local\Temp\58e3ba198cdf68637de2935361095552ed807fb3f66a8b6c6b97a22b9f51685f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 716 -s 44
2⤵
- Program crash
PID:892

memory/716-55-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/892-54-0x0000000000000000-mapping.dmp

Download