ac7cf66eb975d4986e3f9508ae1cb6ddc65cc4ddf4e0cfea2852415b07230cbc

Analysis

max time kernel
3s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:17

Target

ac7cf66eb975d4986e3f9508ae1cb6ddc65cc4ddf4e0cfea2852415b07230cbc.exe
Size

76KB
MD5

f6f8288fd6a657bcae8e38c1b00a6c12
SHA1

66f2086431d4e1724029b1d6f9c601c74b7195a2
SHA256

ac7cf66eb975d4986e3f9508ae1cb6ddc65cc4ddf4e0cfea2852415b07230cbc
SHA512

9a2fb96981d0530de0494faf91e9e178203d4aa10e3d560d1ea38a4c36db65555212739a2ffa4ae060b6065def7823ad7b0acb3649e9ad54c434082c2ffd01ba
SSDEEP

1536:USnRNZlkWn0WFXWpVcpzsT3JGBjmu/Fx50jV3YzJ+utrx3+s62jwr0MoDLMAhq6h:04YfTBKEClpoxEUvNaFHs2qo

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

952 1756 WerFault.exe ac7cf66eb975d4986e3f9508ae1cb6ddc65cc4ddf4e0cfea2852415b07230cbc.exe

pid	pid_target	process	target process
952	1756	WerFault.exe	ac7cf66eb975d4986e3f9508ae1cb6ddc65cc4ddf4e0cfea2852415b07230cbc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ac7cf66eb975d4986e3f9508ae1cb6ddc65cc4ddf4e0cfea2852415b07230cbc.exe

description	pid	process	target process
PID 1756 wrote to memory of 952	1756	ac7cf66eb975d4986e3f9508ae1cb6ddc65cc4ddf4e0cfea2852415b07230cbc.exe	WerFault.exe
PID 1756 wrote to memory of 952	1756	ac7cf66eb975d4986e3f9508ae1cb6ddc65cc4ddf4e0cfea2852415b07230cbc.exe	WerFault.exe
PID 1756 wrote to memory of 952	1756	ac7cf66eb975d4986e3f9508ae1cb6ddc65cc4ddf4e0cfea2852415b07230cbc.exe	WerFault.exe
PID 1756 wrote to memory of 952	1756	ac7cf66eb975d4986e3f9508ae1cb6ddc65cc4ddf4e0cfea2852415b07230cbc.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ac7cf66eb975d4986e3f9508ae1cb6ddc65cc4ddf4e0cfea2852415b07230cbc.exe
"C:\Users\Admin\AppData\Local\Temp\ac7cf66eb975d4986e3f9508ae1cb6ddc65cc4ddf4e0cfea2852415b07230cbc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 36
2⤵
- Program crash
PID:952

memory/952-54-0x0000000000000000-mapping.dmp

Download
memory/1756-55-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download