96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6

Analysis

max time kernel
9s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:22

Target

96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe
Size

62KB
MD5

96cd42c92b68e357621dd9b14ea5d571
SHA1

1c946ffab8485ddc191133a03143dca5b02716d0
SHA256

96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6
SHA512

02f1f47b00b1c4c97fc85057fb510ea1c4d1818a81a6646cd087965480b2afd3d5e1176b0f9e94f97c077d3cb282ee6d9647918731c17a7ee8672c9a3079f2d8
SSDEEP

1536:ytILkfv8tbWEtuM/lrWtObSLOlNkW+iUsGzmhclV9q4wsYK7fui4V/u1nT7:ytIFt3tb/lrWcUsp+sGyK0qYOmi4V/qH

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

936 1432 WerFault.exe 96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe

pid	pid_target	process	target process
936	1432	WerFault.exe	96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe

description	pid	process	target process
PID 1432 wrote to memory of 936	1432	96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe	WerFault.exe
PID 1432 wrote to memory of 936	1432	96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe	WerFault.exe
PID 1432 wrote to memory of 936	1432	96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe	WerFault.exe
PID 1432 wrote to memory of 936	1432	96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe
"C:\Users\Admin\AppData\Local\Temp\96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 36
2⤵
- Program crash
PID:936

memory/936-54-0x0000000000000000-mapping.dmp

Download
memory/1432-55-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download