b0b2f2a635428c77d6010e95a630b72c20c46484e8d3c82ccb89afe55129a514

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:17

Target

b0b2f2a635428c77d6010e95a630b72c20c46484e8d3c82ccb89afe55129a514.exe
Size

76KB
MD5

4f3bd896524ef98ad3eff905feb2dbf6
SHA1

7a291c1a68f75b3f69f7d472186ce0bbb60f5b89
SHA256

b0b2f2a635428c77d6010e95a630b72c20c46484e8d3c82ccb89afe55129a514
SHA512

11133bcd0f2f3e0a197d9063caeda1ae7586d73daef9476fce687193b2e06a2006a76c773983e92216181764154f37719d017ee4a3bb3795ca737808724c79c0
SSDEEP

1536:6XM6bE8luCnYatK9rKdk+Yxsha/X9tlgnNCm7x6pjVrs2ryrd1vUQuq6:6JCCnJwMduSa/dkCg6Hs2qo

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

884 1080 WerFault.exe b0b2f2a635428c77d6010e95a630b72c20c46484e8d3c82ccb89afe55129a514.exe

pid	pid_target	process	target process
884	1080	WerFault.exe	b0b2f2a635428c77d6010e95a630b72c20c46484e8d3c82ccb89afe55129a514.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b0b2f2a635428c77d6010e95a630b72c20c46484e8d3c82ccb89afe55129a514.exe

description	pid	process	target process
PID 1080 wrote to memory of 884	1080	b0b2f2a635428c77d6010e95a630b72c20c46484e8d3c82ccb89afe55129a514.exe	WerFault.exe
PID 1080 wrote to memory of 884	1080	b0b2f2a635428c77d6010e95a630b72c20c46484e8d3c82ccb89afe55129a514.exe	WerFault.exe
PID 1080 wrote to memory of 884	1080	b0b2f2a635428c77d6010e95a630b72c20c46484e8d3c82ccb89afe55129a514.exe	WerFault.exe
PID 1080 wrote to memory of 884	1080	b0b2f2a635428c77d6010e95a630b72c20c46484e8d3c82ccb89afe55129a514.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\b0b2f2a635428c77d6010e95a630b72c20c46484e8d3c82ccb89afe55129a514.exe
"C:\Users\Admin\AppData\Local\Temp\b0b2f2a635428c77d6010e95a630b72c20c46484e8d3c82ccb89afe55129a514.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 36
2⤵
- Program crash
PID:884

memory/884-54-0x0000000000000000-mapping.dmp

Download
memory/1080-55-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download