364e86072494c6f23c28c0f028098d5ffdfbb45f60de0ff89db2e130c6dfb86f

Analysis

max time kernel
4s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:23

Target

364e86072494c6f23c28c0f028098d5ffdfbb45f60de0ff89db2e130c6dfb86f.exe
Size

62KB
MD5

ab8c62d3c7e9205b28fe67ab9fd5c6ba
SHA1

6c91087a8f6db6d1f92dd0ea32f7a5ebe7801ea6
SHA256

364e86072494c6f23c28c0f028098d5ffdfbb45f60de0ff89db2e130c6dfb86f
SHA512

c0a4eeb94049b87b21fa3824f8d3b76dbca6380be032105100c970389ef3d1ac64651c0a9a7359b6dbbbe87a658aa13e004d2819640be69d0a80cad2aac46d2a
SSDEEP

1536:37CqkWJgu6KjLGK01C4+ySR3b+d0f94sCXSmMfV:3rkK62S1+yY+d7sN79

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

904 1332 WerFault.exe 364e86072494c6f23c28c0f028098d5ffdfbb45f60de0ff89db2e130c6dfb86f.exe

pid	pid_target	process	target process
904	1332	WerFault.exe	364e86072494c6f23c28c0f028098d5ffdfbb45f60de0ff89db2e130c6dfb86f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

364e86072494c6f23c28c0f028098d5ffdfbb45f60de0ff89db2e130c6dfb86f.exe

description	pid	process	target process
PID 1332 wrote to memory of 904	1332	364e86072494c6f23c28c0f028098d5ffdfbb45f60de0ff89db2e130c6dfb86f.exe	WerFault.exe
PID 1332 wrote to memory of 904	1332	364e86072494c6f23c28c0f028098d5ffdfbb45f60de0ff89db2e130c6dfb86f.exe	WerFault.exe
PID 1332 wrote to memory of 904	1332	364e86072494c6f23c28c0f028098d5ffdfbb45f60de0ff89db2e130c6dfb86f.exe	WerFault.exe
PID 1332 wrote to memory of 904	1332	364e86072494c6f23c28c0f028098d5ffdfbb45f60de0ff89db2e130c6dfb86f.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\364e86072494c6f23c28c0f028098d5ffdfbb45f60de0ff89db2e130c6dfb86f.exe
"C:\Users\Admin\AppData\Local\Temp\364e86072494c6f23c28c0f028098d5ffdfbb45f60de0ff89db2e130c6dfb86f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 36
2⤵
- Program crash
PID:904

memory/904-54-0x0000000000000000-mapping.dmp

Download
memory/1332-55-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download