b241fdcb0e126ee63a6f2e53a7b6ac2a69ca6a3b7eadcbb0edfbc06cd3e60506

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:21

Target

b241fdcb0e126ee63a6f2e53a7b6ac2a69ca6a3b7eadcbb0edfbc06cd3e60506.exe
Size

66KB
MD5

8b9f223c7517649131bb7cb4019ebc71
SHA1

5218652e4d8c344747fcb5435bcb75c355d4f94a
SHA256

b241fdcb0e126ee63a6f2e53a7b6ac2a69ca6a3b7eadcbb0edfbc06cd3e60506
SHA512

08d48a4b4b9330fef64f431f120b27c7899b154f64c0551caf3efffe5915ccfe22949b7e7e68c1ad5f82b49d9432f270c3098cc273174dbcb22031e186b1d552
SSDEEP

1536:nRCPmoZK/DydoBdUz6QDGyG+JTHU/QQ5+9ul6KDe8c3Sq4f2N:nR2mSMDMB5JJL+b+9ZKq80SDK

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1396 1600 WerFault.exe b241fdcb0e126ee63a6f2e53a7b6ac2a69ca6a3b7eadcbb0edfbc06cd3e60506.exe

pid	pid_target	process	target process
1396	1600	WerFault.exe	b241fdcb0e126ee63a6f2e53a7b6ac2a69ca6a3b7eadcbb0edfbc06cd3e60506.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b241fdcb0e126ee63a6f2e53a7b6ac2a69ca6a3b7eadcbb0edfbc06cd3e60506.exe

description	pid	process	target process
PID 1600 wrote to memory of 1396	1600	b241fdcb0e126ee63a6f2e53a7b6ac2a69ca6a3b7eadcbb0edfbc06cd3e60506.exe	WerFault.exe
PID 1600 wrote to memory of 1396	1600	b241fdcb0e126ee63a6f2e53a7b6ac2a69ca6a3b7eadcbb0edfbc06cd3e60506.exe	WerFault.exe
PID 1600 wrote to memory of 1396	1600	b241fdcb0e126ee63a6f2e53a7b6ac2a69ca6a3b7eadcbb0edfbc06cd3e60506.exe	WerFault.exe
PID 1600 wrote to memory of 1396	1600	b241fdcb0e126ee63a6f2e53a7b6ac2a69ca6a3b7eadcbb0edfbc06cd3e60506.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\b241fdcb0e126ee63a6f2e53a7b6ac2a69ca6a3b7eadcbb0edfbc06cd3e60506.exe
"C:\Users\Admin\AppData\Local\Temp\b241fdcb0e126ee63a6f2e53a7b6ac2a69ca6a3b7eadcbb0edfbc06cd3e60506.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 36
  2⤵
  - Program crash
  PID:1396

memory/1396-54-0x0000000000000000-mapping.dmp

Download
memory/1600-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download