f24b099c6ea649cd0b3f70ed6aa27fab77d11b75d556e332d6ab832f9a680593

Analysis

max time kernel
17s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:19

Target

f24b099c6ea649cd0b3f70ed6aa27fab77d11b75d556e332d6ab832f9a680593.exe
Size

66KB
MD5

d114afbd00accfd49c7ec2fac325c29d
SHA1

1baf0037499ecab25e578770d29a593e4e01d3fe
SHA256

f24b099c6ea649cd0b3f70ed6aa27fab77d11b75d556e332d6ab832f9a680593
SHA512

a5a3b140f7f15aade228ea4fe3d1daf604690c8b8c71d301eb540296f04fe4965bd4d04ed8783863f4e33f3c88dfb21b2b66c372c4394a07056c0c8b3904d787
SSDEEP

1536:kT2JN6D7FrezCX9UCHgzx3sbdJ14FFtRRKunNLFqIsuLlCm8OTY:klMCHHqFBVzqdKCm8OTY

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1208 872 WerFault.exe f24b099c6ea649cd0b3f70ed6aa27fab77d11b75d556e332d6ab832f9a680593.exe

pid	pid_target	process	target process
1208	872	WerFault.exe	f24b099c6ea649cd0b3f70ed6aa27fab77d11b75d556e332d6ab832f9a680593.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f24b099c6ea649cd0b3f70ed6aa27fab77d11b75d556e332d6ab832f9a680593.exe

description	pid	process	target process
PID 872 wrote to memory of 1208	872	f24b099c6ea649cd0b3f70ed6aa27fab77d11b75d556e332d6ab832f9a680593.exe	WerFault.exe
PID 872 wrote to memory of 1208	872	f24b099c6ea649cd0b3f70ed6aa27fab77d11b75d556e332d6ab832f9a680593.exe	WerFault.exe
PID 872 wrote to memory of 1208	872	f24b099c6ea649cd0b3f70ed6aa27fab77d11b75d556e332d6ab832f9a680593.exe	WerFault.exe
PID 872 wrote to memory of 1208	872	f24b099c6ea649cd0b3f70ed6aa27fab77d11b75d556e332d6ab832f9a680593.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f24b099c6ea649cd0b3f70ed6aa27fab77d11b75d556e332d6ab832f9a680593.exe
"C:\Users\Admin\AppData\Local\Temp\f24b099c6ea649cd0b3f70ed6aa27fab77d11b75d556e332d6ab832f9a680593.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 36
2⤵
- Program crash
PID:1208

memory/872-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1208-54-0x0000000000000000-mapping.dmp

Download