a81947c332f7a72846cd2b9aa6ae5b3ef6fd76930abcc7fccdcfb389bddb90b4

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:21

Target

a81947c332f7a72846cd2b9aa6ae5b3ef6fd76930abcc7fccdcfb389bddb90b4.exe
Size

56KB
MD5

abd8b9693d99f8824b1e400b6c38f7bb
SHA1

f4812049e3aa9299f9e8700c6c18f264671b49c9
SHA256

a81947c332f7a72846cd2b9aa6ae5b3ef6fd76930abcc7fccdcfb389bddb90b4
SHA512

ed7685bbfdd8b3564a2236ab81977441f55c98225fe6a52b975779b24a17da81cdba34e0f3f3683dff6b7da62db8fa94907ac1335bdf01d1e2a41c4b87e848c1
SSDEEP

1536:OWS+sAKqjnYVl204Y455jHVTKe7Un2eRVlxQA9L:Ox+s8YVl2vx9VTx7U2GYk

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1204 832 WerFault.exe a81947c332f7a72846cd2b9aa6ae5b3ef6fd76930abcc7fccdcfb389bddb90b4.exe

pid	pid_target	process	target process
1204	832	WerFault.exe	a81947c332f7a72846cd2b9aa6ae5b3ef6fd76930abcc7fccdcfb389bddb90b4.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a81947c332f7a72846cd2b9aa6ae5b3ef6fd76930abcc7fccdcfb389bddb90b4.exe

description	pid	process	target process
PID 832 wrote to memory of 1204	832	a81947c332f7a72846cd2b9aa6ae5b3ef6fd76930abcc7fccdcfb389bddb90b4.exe	WerFault.exe
PID 832 wrote to memory of 1204	832	a81947c332f7a72846cd2b9aa6ae5b3ef6fd76930abcc7fccdcfb389bddb90b4.exe	WerFault.exe
PID 832 wrote to memory of 1204	832	a81947c332f7a72846cd2b9aa6ae5b3ef6fd76930abcc7fccdcfb389bddb90b4.exe	WerFault.exe
PID 832 wrote to memory of 1204	832	a81947c332f7a72846cd2b9aa6ae5b3ef6fd76930abcc7fccdcfb389bddb90b4.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a81947c332f7a72846cd2b9aa6ae5b3ef6fd76930abcc7fccdcfb389bddb90b4.exe
"C:\Users\Admin\AppData\Local\Temp\a81947c332f7a72846cd2b9aa6ae5b3ef6fd76930abcc7fccdcfb389bddb90b4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 36
2⤵
- Program crash
PID:1204