7d52c35e2d973e7527593a621dfb4c1b4863e4130f8710022ffcba218ca1f6fd

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:22

Target

7d52c35e2d973e7527593a621dfb4c1b4863e4130f8710022ffcba218ca1f6fd.exe
Size

66KB
MD5

37ab2b8a3bf628d1db12491d83d8d52b
SHA1

13908cd678d7130f6cefde19965464728c68f37f
SHA256

7d52c35e2d973e7527593a621dfb4c1b4863e4130f8710022ffcba218ca1f6fd
SHA512

16fecac1d0a338d34bd66f904df0c9d423520ba15af0282b942b6aadf222c62526a7ec3f93788ff9182358c34b264a448c31a1552907f1cb2286f4673deae74e
SSDEEP

1536:7T7IVQnlvtbHpAPkaUZxhojaShHVS8dsBqJxxVfBd:7PrvJHpAPkamoO6HVSzG1fL

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1664 1100 WerFault.exe 7d52c35e2d973e7527593a621dfb4c1b4863e4130f8710022ffcba218ca1f6fd.exe

pid	pid_target	process	target process
1664	1100	WerFault.exe	7d52c35e2d973e7527593a621dfb4c1b4863e4130f8710022ffcba218ca1f6fd.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7d52c35e2d973e7527593a621dfb4c1b4863e4130f8710022ffcba218ca1f6fd.exe

description	pid	process	target process
PID 1100 wrote to memory of 1664	1100	7d52c35e2d973e7527593a621dfb4c1b4863e4130f8710022ffcba218ca1f6fd.exe	WerFault.exe
PID 1100 wrote to memory of 1664	1100	7d52c35e2d973e7527593a621dfb4c1b4863e4130f8710022ffcba218ca1f6fd.exe	WerFault.exe
PID 1100 wrote to memory of 1664	1100	7d52c35e2d973e7527593a621dfb4c1b4863e4130f8710022ffcba218ca1f6fd.exe	WerFault.exe
PID 1100 wrote to memory of 1664	1100	7d52c35e2d973e7527593a621dfb4c1b4863e4130f8710022ffcba218ca1f6fd.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7d52c35e2d973e7527593a621dfb4c1b4863e4130f8710022ffcba218ca1f6fd.exe
"C:\Users\Admin\AppData\Local\Temp\7d52c35e2d973e7527593a621dfb4c1b4863e4130f8710022ffcba218ca1f6fd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 36
2⤵
- Program crash
PID:1664

memory/1100-55-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1664-54-0x0000000000000000-mapping.dmp

Download