d8e2ea4afee40f796b7be6e954ce0042eee67e778846e9137f45cc5ad0197f2d

Analysis

max time kernel
20s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:17

Target

d8e2ea4afee40f796b7be6e954ce0042eee67e778846e9137f45cc5ad0197f2d.exe
Size

76KB
MD5

f2d072c3604ee7bc37861febebdf36db
SHA1

6e41143675aef46b16d964cb75a22b4febd98c51
SHA256

d8e2ea4afee40f796b7be6e954ce0042eee67e778846e9137f45cc5ad0197f2d
SHA512

5116e242b442a2bf3a0d10c767ba9d07f5d2b181835f1d217d39ac0a20d1af3b06a813bebcda76337221f121e4db00ffa4b02f263b9051bb354101fcac3a15c1
SSDEEP

1536:hou+sEabsRRc0/Hn3EEMKDXyGlY1KWwpjVrs2ryrd1vUQuq6:Xknf3EnKDdNWwHs2qo

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1160 748 WerFault.exe d8e2ea4afee40f796b7be6e954ce0042eee67e778846e9137f45cc5ad0197f2d.exe

pid	pid_target	process	target process
1160	748	WerFault.exe	d8e2ea4afee40f796b7be6e954ce0042eee67e778846e9137f45cc5ad0197f2d.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d8e2ea4afee40f796b7be6e954ce0042eee67e778846e9137f45cc5ad0197f2d.exe

description	pid	process	target process
PID 748 wrote to memory of 1160	748	d8e2ea4afee40f796b7be6e954ce0042eee67e778846e9137f45cc5ad0197f2d.exe	WerFault.exe
PID 748 wrote to memory of 1160	748	d8e2ea4afee40f796b7be6e954ce0042eee67e778846e9137f45cc5ad0197f2d.exe	WerFault.exe
PID 748 wrote to memory of 1160	748	d8e2ea4afee40f796b7be6e954ce0042eee67e778846e9137f45cc5ad0197f2d.exe	WerFault.exe
PID 748 wrote to memory of 1160	748	d8e2ea4afee40f796b7be6e954ce0042eee67e778846e9137f45cc5ad0197f2d.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\d8e2ea4afee40f796b7be6e954ce0042eee67e778846e9137f45cc5ad0197f2d.exe
"C:\Users\Admin\AppData\Local\Temp\d8e2ea4afee40f796b7be6e954ce0042eee67e778846e9137f45cc5ad0197f2d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 36
  2⤵
  - Program crash
  PID:1160

memory/748-55-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1160-54-0x0000000000000000-mapping.dmp

Download