3554764d8acbf1c4c781ba405f4d3c3fbb81b03bd804d3ba76bf82017ec3077a

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:19

Target

3554764d8acbf1c4c781ba405f4d3c3fbb81b03bd804d3ba76bf82017ec3077a.exe
Size

58KB
MD5

842d2f4733985471374161a50ad1c5b1
SHA1

c9b92545478a99ca87c6c918c5b5a175643c0e57
SHA256

3554764d8acbf1c4c781ba405f4d3c3fbb81b03bd804d3ba76bf82017ec3077a
SHA512

edaa98af1a9b546e0f32d9d906c0d0e95717e7a39cb233d82506ce5b36c60e33d4d99748c6dc2045045d58c06541390c9078c0c6821fd853d5d493494a7c17cd
SSDEEP

1536:Hshj1oU9IH2htXrx0y2I7yk708RCyKtt7I20tNO7KBMk6Z8E:Mfp9IWhtXCXIFmONMhN

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1808 1324 WerFault.exe 3554764d8acbf1c4c781ba405f4d3c3fbb81b03bd804d3ba76bf82017ec3077a.exe

pid	pid_target	process	target process
1808	1324	WerFault.exe	3554764d8acbf1c4c781ba405f4d3c3fbb81b03bd804d3ba76bf82017ec3077a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3554764d8acbf1c4c781ba405f4d3c3fbb81b03bd804d3ba76bf82017ec3077a.exe

description	pid	process	target process
PID 1324 wrote to memory of 1808	1324	3554764d8acbf1c4c781ba405f4d3c3fbb81b03bd804d3ba76bf82017ec3077a.exe	WerFault.exe
PID 1324 wrote to memory of 1808	1324	3554764d8acbf1c4c781ba405f4d3c3fbb81b03bd804d3ba76bf82017ec3077a.exe	WerFault.exe
PID 1324 wrote to memory of 1808	1324	3554764d8acbf1c4c781ba405f4d3c3fbb81b03bd804d3ba76bf82017ec3077a.exe	WerFault.exe
PID 1324 wrote to memory of 1808	1324	3554764d8acbf1c4c781ba405f4d3c3fbb81b03bd804d3ba76bf82017ec3077a.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3554764d8acbf1c4c781ba405f4d3c3fbb81b03bd804d3ba76bf82017ec3077a.exe
"C:\Users\Admin\AppData\Local\Temp\3554764d8acbf1c4c781ba405f4d3c3fbb81b03bd804d3ba76bf82017ec3077a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 36
2⤵
- Program crash
PID:1808

memory/1324-55-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1808-54-0x0000000000000000-mapping.dmp

Download