de7bcd391a4734de168697522c4060b969bd5f52fdaf2c8478d32b3302a49ec8

Analysis

max time kernel
4s
max time network
29s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:20

Target

de7bcd391a4734de168697522c4060b969bd5f52fdaf2c8478d32b3302a49ec8.exe
Size

66KB
MD5

d0bcc22a09163bbfdf374ed82625a92d
SHA1

803079ee4a3842e5518048d21c07cf7fe0865380
SHA256

de7bcd391a4734de168697522c4060b969bd5f52fdaf2c8478d32b3302a49ec8
SHA512

c4eefa5ad56c78bb88583778a8db67dc935665ef159cf8c83469322f2d054d0d1bd9c317c65ca8d9911c4484c537dd81c18fcd1f14f526af3eaa0513dbe756b2
SSDEEP

1536:K9ZyHMEeCPhGFb+NN5xoVB8Q+okVsQNXY8:Kn2MEp2+ToVB8p/X1

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1096 1228 WerFault.exe de7bcd391a4734de168697522c4060b969bd5f52fdaf2c8478d32b3302a49ec8.exe

pid	pid_target	process	target process
1096	1228	WerFault.exe	de7bcd391a4734de168697522c4060b969bd5f52fdaf2c8478d32b3302a49ec8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

de7bcd391a4734de168697522c4060b969bd5f52fdaf2c8478d32b3302a49ec8.exe

description	pid	process	target process
PID 1228 wrote to memory of 1096	1228	de7bcd391a4734de168697522c4060b969bd5f52fdaf2c8478d32b3302a49ec8.exe	WerFault.exe
PID 1228 wrote to memory of 1096	1228	de7bcd391a4734de168697522c4060b969bd5f52fdaf2c8478d32b3302a49ec8.exe	WerFault.exe
PID 1228 wrote to memory of 1096	1228	de7bcd391a4734de168697522c4060b969bd5f52fdaf2c8478d32b3302a49ec8.exe	WerFault.exe
PID 1228 wrote to memory of 1096	1228	de7bcd391a4734de168697522c4060b969bd5f52fdaf2c8478d32b3302a49ec8.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\de7bcd391a4734de168697522c4060b969bd5f52fdaf2c8478d32b3302a49ec8.exe
"C:\Users\Admin\AppData\Local\Temp\de7bcd391a4734de168697522c4060b969bd5f52fdaf2c8478d32b3302a49ec8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 36
2⤵
- Program crash
PID:1096

memory/1096-54-0x0000000000000000-mapping.dmp

Download
memory/1228-55-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download