39452fcd0ef10516ac6c9f89dd59c1b523c720103c6ca31466053272d3baca41

Analysis

max time kernel
67s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:16

Target

39452fcd0ef10516ac6c9f89dd59c1b523c720103c6ca31466053272d3baca41.exe
Size

104KB
MD5

1b0a8c2b1e2d15841f8f215bf4c50a31
SHA1

1cbcefe6c069034d59480d219fb52fd56005a32a
SHA256

39452fcd0ef10516ac6c9f89dd59c1b523c720103c6ca31466053272d3baca41
SHA512

ccfc685dfb5e0d83083a3124f8583b047b88fa1a11e94dc4020cd14d17df5cb4bfa7553dd371f48c58dda3c4bfa103f368c9c105c5c3a1b2ecd92f30b3cac5e5
SSDEEP

1536:S0sCro7F6Nizn5eSREezPdBGWGsVO2vYM+P9hI5QJBIv:Do1nDEerGWGsVOTI5yIv

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1296 1256 WerFault.exe 39452fcd0ef10516ac6c9f89dd59c1b523c720103c6ca31466053272d3baca41.exe

pid	pid_target	process	target process
1296	1256	WerFault.exe	39452fcd0ef10516ac6c9f89dd59c1b523c720103c6ca31466053272d3baca41.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

39452fcd0ef10516ac6c9f89dd59c1b523c720103c6ca31466053272d3baca41.exe

description	pid	process	target process
PID 1256 wrote to memory of 1296	1256	39452fcd0ef10516ac6c9f89dd59c1b523c720103c6ca31466053272d3baca41.exe	WerFault.exe
PID 1256 wrote to memory of 1296	1256	39452fcd0ef10516ac6c9f89dd59c1b523c720103c6ca31466053272d3baca41.exe	WerFault.exe
PID 1256 wrote to memory of 1296	1256	39452fcd0ef10516ac6c9f89dd59c1b523c720103c6ca31466053272d3baca41.exe	WerFault.exe
PID 1256 wrote to memory of 1296	1256	39452fcd0ef10516ac6c9f89dd59c1b523c720103c6ca31466053272d3baca41.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\39452fcd0ef10516ac6c9f89dd59c1b523c720103c6ca31466053272d3baca41.exe
"C:\Users\Admin\AppData\Local\Temp\39452fcd0ef10516ac6c9f89dd59c1b523c720103c6ca31466053272d3baca41.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 44
2⤵
- Program crash
PID:1296