a315477156cb7f64f5bcb58cc2be26287407e231a4064e18c96ff5bdd63414ab

Analysis

max time kernel
24s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:30

Target

a315477156cb7f64f5bcb58cc2be26287407e231a4064e18c96ff5bdd63414ab.exe
Size

96KB
MD5

cb83405b4078bec1db8692cddb6aa9d8
SHA1

4b5fd12710f6c72c189d01927db22fe74beb44f9
SHA256

a315477156cb7f64f5bcb58cc2be26287407e231a4064e18c96ff5bdd63414ab
SHA512

4249085b397587ee7516be9e3fcab011e61ed02055f2b39d758c7965bc7cb0a1d4f5e54ec687e99452575a0e8bbe8f635a8c5e86c4a41c565de9ad9460bc516e
SSDEEP

1536:e2V20XYBjJEd7+hwLyDLsPFx3OiS6dfEvsxS3M:e2VdX7Xx+iETc

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1220 1516 WerFault.exe a315477156cb7f64f5bcb58cc2be26287407e231a4064e18c96ff5bdd63414ab.exe

pid	pid_target	process	target process
1220	1516	WerFault.exe	a315477156cb7f64f5bcb58cc2be26287407e231a4064e18c96ff5bdd63414ab.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a315477156cb7f64f5bcb58cc2be26287407e231a4064e18c96ff5bdd63414ab.exe

description	pid	process	target process
PID 1516 wrote to memory of 1220	1516	a315477156cb7f64f5bcb58cc2be26287407e231a4064e18c96ff5bdd63414ab.exe	WerFault.exe
PID 1516 wrote to memory of 1220	1516	a315477156cb7f64f5bcb58cc2be26287407e231a4064e18c96ff5bdd63414ab.exe	WerFault.exe
PID 1516 wrote to memory of 1220	1516	a315477156cb7f64f5bcb58cc2be26287407e231a4064e18c96ff5bdd63414ab.exe	WerFault.exe
PID 1516 wrote to memory of 1220	1516	a315477156cb7f64f5bcb58cc2be26287407e231a4064e18c96ff5bdd63414ab.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a315477156cb7f64f5bcb58cc2be26287407e231a4064e18c96ff5bdd63414ab.exe
"C:\Users\Admin\AppData\Local\Temp\a315477156cb7f64f5bcb58cc2be26287407e231a4064e18c96ff5bdd63414ab.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 88
2⤵
- Program crash
PID:1220

memory/1220-55-0x0000000000000000-mapping.dmp

Download
memory/1516-54-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download