c431926603f4a2dbba0341ccd114da8c46bc94b10f0a2a38e26a50fd4db192db

Analysis

max time kernel
240s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:17

Target

c431926603f4a2dbba0341ccd114da8c46bc94b10f0a2a38e26a50fd4db192db.exe
Size

58KB
MD5

a89fcdcd4476a5ae324656780f3ffa04
SHA1

ddf66abb413827b88cc4adaee6d417aef78a8b9a
SHA256

c431926603f4a2dbba0341ccd114da8c46bc94b10f0a2a38e26a50fd4db192db
SHA512

26fdccd6da6bb7b63a4eee23929e712fc580a426bd04fc921059e60994d240710a71fe1e878c9f6d41651d9a24916af3dc26fe420f6d938eeb498ca93dd754d9
SSDEEP

1536:P0zw4Qr37v8MGo8vLkCE/JUq3mDP3Sxua2EdhRCp+0/C2LZZGZ8E:8JMG/vLkBV3mr3SxusCda2LON

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

596 772 WerFault.exe c431926603f4a2dbba0341ccd114da8c46bc94b10f0a2a38e26a50fd4db192db.exe

pid	pid_target	process	target process
596	772	WerFault.exe	c431926603f4a2dbba0341ccd114da8c46bc94b10f0a2a38e26a50fd4db192db.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c431926603f4a2dbba0341ccd114da8c46bc94b10f0a2a38e26a50fd4db192db.exe

description	pid	process	target process
PID 772 wrote to memory of 596	772	c431926603f4a2dbba0341ccd114da8c46bc94b10f0a2a38e26a50fd4db192db.exe	WerFault.exe
PID 772 wrote to memory of 596	772	c431926603f4a2dbba0341ccd114da8c46bc94b10f0a2a38e26a50fd4db192db.exe	WerFault.exe
PID 772 wrote to memory of 596	772	c431926603f4a2dbba0341ccd114da8c46bc94b10f0a2a38e26a50fd4db192db.exe	WerFault.exe
PID 772 wrote to memory of 596	772	c431926603f4a2dbba0341ccd114da8c46bc94b10f0a2a38e26a50fd4db192db.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c431926603f4a2dbba0341ccd114da8c46bc94b10f0a2a38e26a50fd4db192db.exe
"C:\Users\Admin\AppData\Local\Temp\c431926603f4a2dbba0341ccd114da8c46bc94b10f0a2a38e26a50fd4db192db.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 36
  2⤵
  - Program crash
  PID:596

memory/596-54-0x0000000000000000-mapping.dmp

Download
memory/772-55-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download