bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773

Analysis

max time kernel
46s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:21

Target

bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe
Size

90KB
MD5

474df35b4480320b8f8752def8f5c062
SHA1

260df0a8545cb59e8c1945c60a0cf26c6706e373
SHA256

bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773
SHA512

73fc10d2b79099a66375352cd745177f5a69d7d55dc793f50a81aee781a353462e20349f1248c3c0cdecb073339406e28770d2489f1b0833030efbe01e7a9dbb
SSDEEP

1536:c2te/LgkQHYQ66eKdUxIur5i4Dv2bE+2QklIyjpbgotBN8WKutyG0QMUX:/M/xge6ZU5rRDv2bNWe09gotfbtLX

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1136 2044 WerFault.exe bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe

pid	pid_target	process	target process
1136	2044	WerFault.exe	bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe

description	pid	process	target process
PID 2044 wrote to memory of 1136	2044	bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe	WerFault.exe
PID 2044 wrote to memory of 1136	2044	bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe	WerFault.exe
PID 2044 wrote to memory of 1136	2044	bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe	WerFault.exe
PID 2044 wrote to memory of 1136	2044	bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe
"C:\Users\Admin\AppData\Local\Temp\bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 36
2⤵
- Program crash
PID:1136

memory/1136-54-0x0000000000000000-mapping.dmp

Download
memory/2044-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download