fa57cc379b1c1ca3127712e5eb637fe71ea3b70a6b3fcfb3da725f860ae2cde7

Analysis

max time kernel
24s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:19

Target

fa57cc379b1c1ca3127712e5eb637fe71ea3b70a6b3fcfb3da725f860ae2cde7.exe
Size

228KB
MD5

8b3f1e1e766e0ffa8e942a550b89c336
SHA1

e0b1a6614ff221cc026c2599edba9956dc44b135
SHA256

fa57cc379b1c1ca3127712e5eb637fe71ea3b70a6b3fcfb3da725f860ae2cde7
SHA512

7a822f0702f80db486b79e8eabf632e7bfd2c5f36bd9a2f066bd00683e3c5e4717628f12aa53215c1219534ba8b2d99dbe2637cc3d194fa1c6f9f8228d6439d7
SSDEEP

3072:ZS8LN+aF2rxlTxI+rYWZPO38ugrkT5kTyB7mqOqTWYBh0wngAlXcEWuG1D+D5hPe:vsFlT6QNWerkyTQN7+EbD51usPXSGBsf

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1096 1268 WerFault.exe fa57cc379b1c1ca3127712e5eb637fe71ea3b70a6b3fcfb3da725f860ae2cde7.exe

pid	pid_target	process	target process
1096	1268	WerFault.exe	fa57cc379b1c1ca3127712e5eb637fe71ea3b70a6b3fcfb3da725f860ae2cde7.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fa57cc379b1c1ca3127712e5eb637fe71ea3b70a6b3fcfb3da725f860ae2cde7.exe

description	pid	process	target process
PID 1268 wrote to memory of 1096	1268	fa57cc379b1c1ca3127712e5eb637fe71ea3b70a6b3fcfb3da725f860ae2cde7.exe	WerFault.exe
PID 1268 wrote to memory of 1096	1268	fa57cc379b1c1ca3127712e5eb637fe71ea3b70a6b3fcfb3da725f860ae2cde7.exe	WerFault.exe
PID 1268 wrote to memory of 1096	1268	fa57cc379b1c1ca3127712e5eb637fe71ea3b70a6b3fcfb3da725f860ae2cde7.exe	WerFault.exe
PID 1268 wrote to memory of 1096	1268	fa57cc379b1c1ca3127712e5eb637fe71ea3b70a6b3fcfb3da725f860ae2cde7.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fa57cc379b1c1ca3127712e5eb637fe71ea3b70a6b3fcfb3da725f860ae2cde7.exe
"C:\Users\Admin\AppData\Local\Temp\fa57cc379b1c1ca3127712e5eb637fe71ea3b70a6b3fcfb3da725f860ae2cde7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 36
  2⤵
  - Program crash
  PID:1096

memory/1096-54-0x0000000000000000-mapping.dmp

Download
memory/1268-55-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download