ca72a770ad05fced0e905abdbe6de45485aa8459576a43702417c263f181de11

Analysis

max time kernel
11s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:20

Target

ca72a770ad05fced0e905abdbe6de45485aa8459576a43702417c263f181de11.exe
Size

56KB
MD5

1dd889e9c586dfaac5f5a5437f39ddb8
SHA1

4225695a5b31d3566568745bd49e13a17c85ed97
SHA256

ca72a770ad05fced0e905abdbe6de45485aa8459576a43702417c263f181de11
SHA512

861aef729907933e3c84fdc25918c9d55a622d57d0423a777aff4264d65f5e2cb4a6b2ea004142bb2185afcaa74bb609803c9280d68f9f84d6dda1ea0a5ce16f
SSDEEP

1536:T6FWPFOhzja4aUWLObmYxbhZuFfW0GaVUBUEO:T6koBHal67xNZuFW05UdO

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

972 1520 WerFault.exe ca72a770ad05fced0e905abdbe6de45485aa8459576a43702417c263f181de11.exe

pid	pid_target	process	target process
972	1520	WerFault.exe	ca72a770ad05fced0e905abdbe6de45485aa8459576a43702417c263f181de11.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ca72a770ad05fced0e905abdbe6de45485aa8459576a43702417c263f181de11.exe

description	pid	process	target process
PID 1520 wrote to memory of 972	1520	ca72a770ad05fced0e905abdbe6de45485aa8459576a43702417c263f181de11.exe	WerFault.exe
PID 1520 wrote to memory of 972	1520	ca72a770ad05fced0e905abdbe6de45485aa8459576a43702417c263f181de11.exe	WerFault.exe
PID 1520 wrote to memory of 972	1520	ca72a770ad05fced0e905abdbe6de45485aa8459576a43702417c263f181de11.exe	WerFault.exe
PID 1520 wrote to memory of 972	1520	ca72a770ad05fced0e905abdbe6de45485aa8459576a43702417c263f181de11.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ca72a770ad05fced0e905abdbe6de45485aa8459576a43702417c263f181de11.exe
"C:\Users\Admin\AppData\Local\Temp\ca72a770ad05fced0e905abdbe6de45485aa8459576a43702417c263f181de11.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 36
2⤵
- Program crash
PID:972

memory/972-54-0x0000000000000000-mapping.dmp

Download
memory/1520-55-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download