0f171eb13102e96ea0cafd5ff494797a4bccadceaa1f81b7689ca6fdecba5a41

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:19

Target

0f171eb13102e96ea0cafd5ff494797a4bccadceaa1f81b7689ca6fdecba5a41.exe
Size

76KB
MD5

69be05f07e74c284ad645060c982dfbd
SHA1

3e26440d0d83e333cbf426954e14dfd4091efb0d
SHA256

0f171eb13102e96ea0cafd5ff494797a4bccadceaa1f81b7689ca6fdecba5a41
SHA512

683b9ca18b4d6c843e50ab7f6842cd001d1556436eae82e4ea6a7c7c43665b4087861327588fa7b667bedc801bda4ca5c6d6222a355eb8ecafcc3324ddff511f
SSDEEP

1536:aiGGG2AUpei7z6AiG38lgTOjiXTKyfQGqpglwqj0JX82hW8fPL9:Xjh0D6KjiXNTJD68vYL9

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1108 1656 WerFault.exe 0f171eb13102e96ea0cafd5ff494797a4bccadceaa1f81b7689ca6fdecba5a41.exe

pid	pid_target	process	target process
1108	1656	WerFault.exe	0f171eb13102e96ea0cafd5ff494797a4bccadceaa1f81b7689ca6fdecba5a41.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0f171eb13102e96ea0cafd5ff494797a4bccadceaa1f81b7689ca6fdecba5a41.exe

description	pid	process	target process
PID 1656 wrote to memory of 1108	1656	0f171eb13102e96ea0cafd5ff494797a4bccadceaa1f81b7689ca6fdecba5a41.exe	WerFault.exe
PID 1656 wrote to memory of 1108	1656	0f171eb13102e96ea0cafd5ff494797a4bccadceaa1f81b7689ca6fdecba5a41.exe	WerFault.exe
PID 1656 wrote to memory of 1108	1656	0f171eb13102e96ea0cafd5ff494797a4bccadceaa1f81b7689ca6fdecba5a41.exe	WerFault.exe
PID 1656 wrote to memory of 1108	1656	0f171eb13102e96ea0cafd5ff494797a4bccadceaa1f81b7689ca6fdecba5a41.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0f171eb13102e96ea0cafd5ff494797a4bccadceaa1f81b7689ca6fdecba5a41.exe
"C:\Users\Admin\AppData\Local\Temp\0f171eb13102e96ea0cafd5ff494797a4bccadceaa1f81b7689ca6fdecba5a41.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 36
2⤵
- Program crash
PID:1108

memory/1108-54-0x0000000000000000-mapping.dmp

Download
memory/1656-55-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download