ff05dd4c00974cfe2d61556babb5dcf003ecf413954ce8e3ce469e5a4bfbba04

Analysis

max time kernel
33s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:16

Target

ff05dd4c00974cfe2d61556babb5dcf003ecf413954ce8e3ce469e5a4bfbba04.exe
Size

175KB
MD5

8a38197918ff7503396debe71630a52d
SHA1

88a505df3aa72165d0eafa7f8b4b720050f1671d
SHA256

ff05dd4c00974cfe2d61556babb5dcf003ecf413954ce8e3ce469e5a4bfbba04
SHA512

3904455a62f1d300f454b1af659a49193f8efce466c165414faadebcaa5926124839fc15a0d7ec451d807c93a7857f4e0eb2cce555057e645b7061bb8bfc5303
SSDEEP

3072:q76gedbFI/pfp5J1OrfN5x9cjnmg7O2NhMF6CRDi47J9GySgWLvm/t6w+Q:EeI/RJ1OMrmg7O2NhRv4lSgWTm/tJ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1696 1000 WerFault.exe ff05dd4c00974cfe2d61556babb5dcf003ecf413954ce8e3ce469e5a4bfbba04.exe

pid	pid_target	process	target process
1696	1000	WerFault.exe	ff05dd4c00974cfe2d61556babb5dcf003ecf413954ce8e3ce469e5a4bfbba04.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ff05dd4c00974cfe2d61556babb5dcf003ecf413954ce8e3ce469e5a4bfbba04.exe

description	pid	process	target process
PID 1000 wrote to memory of 1696	1000	ff05dd4c00974cfe2d61556babb5dcf003ecf413954ce8e3ce469e5a4bfbba04.exe	WerFault.exe
PID 1000 wrote to memory of 1696	1000	ff05dd4c00974cfe2d61556babb5dcf003ecf413954ce8e3ce469e5a4bfbba04.exe	WerFault.exe
PID 1000 wrote to memory of 1696	1000	ff05dd4c00974cfe2d61556babb5dcf003ecf413954ce8e3ce469e5a4bfbba04.exe	WerFault.exe
PID 1000 wrote to memory of 1696	1000	ff05dd4c00974cfe2d61556babb5dcf003ecf413954ce8e3ce469e5a4bfbba04.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ff05dd4c00974cfe2d61556babb5dcf003ecf413954ce8e3ce469e5a4bfbba04.exe
"C:\Users\Admin\AppData\Local\Temp\ff05dd4c00974cfe2d61556babb5dcf003ecf413954ce8e3ce469e5a4bfbba04.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 36
2⤵
- Program crash
PID:1696

memory/1000-54-0x0000000000400000-0x0000000000459A8C-memory.dmp

Filesize
358KB

Download
memory/1696-55-0x0000000000000000-mapping.dmp

Download