000537b2432deb4e26c7c9264d5f91c5febaf637af3679717bbc99b4dc7732c9

Analysis

max time kernel
7s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:24

Target

000537b2432deb4e26c7c9264d5f91c5febaf637af3679717bbc99b4dc7732c9.exe
Size

66KB
MD5

8ec28e0b99c56de6ea932b6c999495d1
SHA1

a0527ea2eaeba3b594c8e096e67a069043a5179f
SHA256

000537b2432deb4e26c7c9264d5f91c5febaf637af3679717bbc99b4dc7732c9
SHA512

1d3538bccd14e09d005512e065711e5146331459b04295f4567ed2bac65baf399ab6f81747896606477e16fc7e03f90baa728a4b1e500e886922a2bc39ea8570
SSDEEP

1536:5YF4VuzUQPb+QTTSa/9YsgOAKaY/2Oxmi5hiF2:ySuF+EN9KKr/jv5hI2

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

828 1128 WerFault.exe 000537b2432deb4e26c7c9264d5f91c5febaf637af3679717bbc99b4dc7732c9.exe

pid	pid_target	process	target process
828	1128	WerFault.exe	000537b2432deb4e26c7c9264d5f91c5febaf637af3679717bbc99b4dc7732c9.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

000537b2432deb4e26c7c9264d5f91c5febaf637af3679717bbc99b4dc7732c9.exe

description	pid	process	target process
PID 1128 wrote to memory of 828	1128	000537b2432deb4e26c7c9264d5f91c5febaf637af3679717bbc99b4dc7732c9.exe	WerFault.exe
PID 1128 wrote to memory of 828	1128	000537b2432deb4e26c7c9264d5f91c5febaf637af3679717bbc99b4dc7732c9.exe	WerFault.exe
PID 1128 wrote to memory of 828	1128	000537b2432deb4e26c7c9264d5f91c5febaf637af3679717bbc99b4dc7732c9.exe	WerFault.exe
PID 1128 wrote to memory of 828	1128	000537b2432deb4e26c7c9264d5f91c5febaf637af3679717bbc99b4dc7732c9.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\000537b2432deb4e26c7c9264d5f91c5febaf637af3679717bbc99b4dc7732c9.exe
"C:\Users\Admin\AppData\Local\Temp\000537b2432deb4e26c7c9264d5f91c5febaf637af3679717bbc99b4dc7732c9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 36
2⤵
- Program crash
PID:828

memory/828-55-0x0000000000000000-mapping.dmp

Download
memory/1128-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download