f51d3efc84c3bef86639ae18a15e122be62c686a08b0d420feedde4dc153c5b6

Analysis

max time kernel
47s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:19

Target

f51d3efc84c3bef86639ae18a15e122be62c686a08b0d420feedde4dc153c5b6.exe
Size

66KB
MD5

d41350fd9b53ffc0d8999489f460ba6c
SHA1

4c5333b6588cdb106573ba33c6cc95cf9be549d5
SHA256

f51d3efc84c3bef86639ae18a15e122be62c686a08b0d420feedde4dc153c5b6
SHA512

2cd108908fbe550e18564dd3920a7dba8d442ecda0eeb0896fe42df687f7ea36d82d0d113b4ff6e2e246588f85aee03da05f2f8a946e4aa60e8e4509e78920b8
SSDEEP

1536:7hGmhiJn3u9b07gpuziB3N6nmf6SCONznzglRIf:7hGmhipe9b07vziBcmCsNznz8uf

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1532 1460 WerFault.exe f51d3efc84c3bef86639ae18a15e122be62c686a08b0d420feedde4dc153c5b6.exe

pid	pid_target	process	target process
1532	1460	WerFault.exe	f51d3efc84c3bef86639ae18a15e122be62c686a08b0d420feedde4dc153c5b6.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f51d3efc84c3bef86639ae18a15e122be62c686a08b0d420feedde4dc153c5b6.exe

description	pid	process	target process
PID 1460 wrote to memory of 1532	1460	f51d3efc84c3bef86639ae18a15e122be62c686a08b0d420feedde4dc153c5b6.exe	WerFault.exe
PID 1460 wrote to memory of 1532	1460	f51d3efc84c3bef86639ae18a15e122be62c686a08b0d420feedde4dc153c5b6.exe	WerFault.exe
PID 1460 wrote to memory of 1532	1460	f51d3efc84c3bef86639ae18a15e122be62c686a08b0d420feedde4dc153c5b6.exe	WerFault.exe
PID 1460 wrote to memory of 1532	1460	f51d3efc84c3bef86639ae18a15e122be62c686a08b0d420feedde4dc153c5b6.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f51d3efc84c3bef86639ae18a15e122be62c686a08b0d420feedde4dc153c5b6.exe
"C:\Users\Admin\AppData\Local\Temp\f51d3efc84c3bef86639ae18a15e122be62c686a08b0d420feedde4dc153c5b6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 36
  2⤵
  - Program crash
  PID:1532

memory/1460-55-0x0000000000400000-0x0000000000426642-memory.dmp

Filesize
153KB

Download
memory/1532-54-0x0000000000000000-mapping.dmp

Download