4878bf8f97d694d7143a7f6a3a60102420f809028fa6e13049e927fb404abe52

Analysis

max time kernel
3s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:23

Target

4878bf8f97d694d7143a7f6a3a60102420f809028fa6e13049e927fb404abe52.exe
Size

75KB
MD5

27d78932325266c5af57c7677546bee9
SHA1

a34bed2b6a55135d4cf87d205f96f1c82b927eaa
SHA256

4878bf8f97d694d7143a7f6a3a60102420f809028fa6e13049e927fb404abe52
SHA512

9f938a6f057963923a7c747e6d44ffe9d62efcc87040bc8f6bee1ee1b7719b716e2219c0ba4b6014f48a3569bf99916ee52ac35b4a2a7f11a08cb2e573b49ebc
SSDEEP

1536:B/Lv2VbNhmj7AKWsvpJXMCD2VtMLazWKzTjefkBB2YIHbaL8aeGsLaG:BXWypyCMMYLefbhbaAJGEaG

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1600 1396 WerFault.exe 4878bf8f97d694d7143a7f6a3a60102420f809028fa6e13049e927fb404abe52.exe

pid	pid_target	process	target process
1600	1396	WerFault.exe	4878bf8f97d694d7143a7f6a3a60102420f809028fa6e13049e927fb404abe52.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4878bf8f97d694d7143a7f6a3a60102420f809028fa6e13049e927fb404abe52.exe

description	pid	process	target process
PID 1396 wrote to memory of 1600	1396	4878bf8f97d694d7143a7f6a3a60102420f809028fa6e13049e927fb404abe52.exe	WerFault.exe
PID 1396 wrote to memory of 1600	1396	4878bf8f97d694d7143a7f6a3a60102420f809028fa6e13049e927fb404abe52.exe	WerFault.exe
PID 1396 wrote to memory of 1600	1396	4878bf8f97d694d7143a7f6a3a60102420f809028fa6e13049e927fb404abe52.exe	WerFault.exe
PID 1396 wrote to memory of 1600	1396	4878bf8f97d694d7143a7f6a3a60102420f809028fa6e13049e927fb404abe52.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4878bf8f97d694d7143a7f6a3a60102420f809028fa6e13049e927fb404abe52.exe
"C:\Users\Admin\AppData\Local\Temp\4878bf8f97d694d7143a7f6a3a60102420f809028fa6e13049e927fb404abe52.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 36
2⤵
- Program crash
PID:1600

memory/1396-54-0x0000000000400000-0x000000000042D642-memory.dmp

Filesize
181KB

Download
memory/1600-55-0x0000000000000000-mapping.dmp

Download