04ddfb3aabfd6794af443f7ddad6083bedba86c7ffc4793c14ce36303df6e0a7

Analysis

max time kernel
15s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:24

Target

04ddfb3aabfd6794af443f7ddad6083bedba86c7ffc4793c14ce36303df6e0a7.exe
Size

66KB
MD5

10ec18e38b60d89c01cd5fea58fb8ba5
SHA1

e6164d7531ac13046889de40c506b2737c6e6ef7
SHA256

04ddfb3aabfd6794af443f7ddad6083bedba86c7ffc4793c14ce36303df6e0a7
SHA512

7fa3889d946eaa40f1cc3686fee4a821766958ae7b0d365b75b9c8b1b3ff98748a6dd8f6f0a169bbb0c04ce19d8b9e548701536269c0b4836d4cddb42c37ee64
SSDEEP

1536:Qm4fyrgAiMw8sJHY1DgdPaB0b5cu5+GUxO0Z6sH22WlXHyKjHKIcv:Qm48ip8s1Y10PaOb5D5I3Q82rlXHyyH4

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1724 1636 WerFault.exe 04ddfb3aabfd6794af443f7ddad6083bedba86c7ffc4793c14ce36303df6e0a7.exe

pid	pid_target	process	target process
1724	1636	WerFault.exe	04ddfb3aabfd6794af443f7ddad6083bedba86c7ffc4793c14ce36303df6e0a7.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

04ddfb3aabfd6794af443f7ddad6083bedba86c7ffc4793c14ce36303df6e0a7.exe

description	pid	process	target process
PID 1636 wrote to memory of 1724	1636	04ddfb3aabfd6794af443f7ddad6083bedba86c7ffc4793c14ce36303df6e0a7.exe	WerFault.exe
PID 1636 wrote to memory of 1724	1636	04ddfb3aabfd6794af443f7ddad6083bedba86c7ffc4793c14ce36303df6e0a7.exe	WerFault.exe
PID 1636 wrote to memory of 1724	1636	04ddfb3aabfd6794af443f7ddad6083bedba86c7ffc4793c14ce36303df6e0a7.exe	WerFault.exe
PID 1636 wrote to memory of 1724	1636	04ddfb3aabfd6794af443f7ddad6083bedba86c7ffc4793c14ce36303df6e0a7.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\04ddfb3aabfd6794af443f7ddad6083bedba86c7ffc4793c14ce36303df6e0a7.exe
"C:\Users\Admin\AppData\Local\Temp\04ddfb3aabfd6794af443f7ddad6083bedba86c7ffc4793c14ce36303df6e0a7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 36
2⤵
- Program crash
PID:1724

memory/1636-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1724-54-0x0000000000000000-mapping.dmp

Download