ad78ca479e1262053e72d57501c545ebcf86573e48bc6ab5bc616221b64e6c20

Analysis

max time kernel
33s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:17

Target

ad78ca479e1262053e72d57501c545ebcf86573e48bc6ab5bc616221b64e6c20.exe
Size

76KB
MD5

99da90c34264d0a8c441d35b975dc3a8
SHA1

c3feed94f010ed7aa13c0ba43bc0d3b0f7bf0e4b
SHA256

ad78ca479e1262053e72d57501c545ebcf86573e48bc6ab5bc616221b64e6c20
SHA512

ede9dd44e60ea399b05d6a078fc15741fc4bc4069739f8fafd1c737a41eac9f70781e248bc7786cca2fe25f5eaffbfdbc1c2c3dbf4d08b1d7bb67bef93440f58
SSDEEP

1536:PKTtTtTtT2PJwzI1r34S7x5FBXv6cfocma1xyl+aMZY4rpjVrs2ryrd1vUQuq6:HJzqwxdXSzha/ylIZ/Hs2qo

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1296 1600 WerFault.exe ad78ca479e1262053e72d57501c545ebcf86573e48bc6ab5bc616221b64e6c20.exe

pid	pid_target	process	target process
1296	1600	WerFault.exe	ad78ca479e1262053e72d57501c545ebcf86573e48bc6ab5bc616221b64e6c20.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ad78ca479e1262053e72d57501c545ebcf86573e48bc6ab5bc616221b64e6c20.exe

description	pid	process	target process
PID 1600 wrote to memory of 1296	1600	ad78ca479e1262053e72d57501c545ebcf86573e48bc6ab5bc616221b64e6c20.exe	WerFault.exe
PID 1600 wrote to memory of 1296	1600	ad78ca479e1262053e72d57501c545ebcf86573e48bc6ab5bc616221b64e6c20.exe	WerFault.exe
PID 1600 wrote to memory of 1296	1600	ad78ca479e1262053e72d57501c545ebcf86573e48bc6ab5bc616221b64e6c20.exe	WerFault.exe
PID 1600 wrote to memory of 1296	1600	ad78ca479e1262053e72d57501c545ebcf86573e48bc6ab5bc616221b64e6c20.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ad78ca479e1262053e72d57501c545ebcf86573e48bc6ab5bc616221b64e6c20.exe
"C:\Users\Admin\AppData\Local\Temp\ad78ca479e1262053e72d57501c545ebcf86573e48bc6ab5bc616221b64e6c20.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 36
  2⤵
  - Program crash
  PID:1296

memory/1296-54-0x0000000000000000-mapping.dmp

Download
memory/1600-55-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download