95cfaa33790e51d6aebe86bd3cde5ac8320e3fbe250b1f1dc3d0ec4e99aadd29

Analysis

max time kernel
16s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:37

Target

95cfaa33790e51d6aebe86bd3cde5ac8320e3fbe250b1f1dc3d0ec4e99aadd29.exe
Size

172KB
MD5

e9dbb935a7f166fd86d5b175c63c8c5f
SHA1

75704d4e40e0c47a30fa82f9fffe2032c8de746f
SHA256

95cfaa33790e51d6aebe86bd3cde5ac8320e3fbe250b1f1dc3d0ec4e99aadd29
SHA512

697444dc4f9d4533726dc88ecb8c5b59103efe6d344e1ca9bd1351bb856317fb9d289162b29cb88456bbbd5126080e6112ddad06dfde9986240779b4ffefe61c
SSDEEP

3072:gjOYneTAzKMaiEwJQp8eVIef5hRmBwBPlkvsiIK:gjOVTAO1iLJ48eSef5rmBwB2E9K

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1492 1940 WerFault.exe 95cfaa33790e51d6aebe86bd3cde5ac8320e3fbe250b1f1dc3d0ec4e99aadd29.exe

pid	pid_target	process	target process
1492	1940	WerFault.exe	95cfaa33790e51d6aebe86bd3cde5ac8320e3fbe250b1f1dc3d0ec4e99aadd29.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

95cfaa33790e51d6aebe86bd3cde5ac8320e3fbe250b1f1dc3d0ec4e99aadd29.exe

description	pid	process	target process
PID 1940 wrote to memory of 1492	1940	95cfaa33790e51d6aebe86bd3cde5ac8320e3fbe250b1f1dc3d0ec4e99aadd29.exe	WerFault.exe
PID 1940 wrote to memory of 1492	1940	95cfaa33790e51d6aebe86bd3cde5ac8320e3fbe250b1f1dc3d0ec4e99aadd29.exe	WerFault.exe
PID 1940 wrote to memory of 1492	1940	95cfaa33790e51d6aebe86bd3cde5ac8320e3fbe250b1f1dc3d0ec4e99aadd29.exe	WerFault.exe
PID 1940 wrote to memory of 1492	1940	95cfaa33790e51d6aebe86bd3cde5ac8320e3fbe250b1f1dc3d0ec4e99aadd29.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\95cfaa33790e51d6aebe86bd3cde5ac8320e3fbe250b1f1dc3d0ec4e99aadd29.exe
"C:\Users\Admin\AppData\Local\Temp\95cfaa33790e51d6aebe86bd3cde5ac8320e3fbe250b1f1dc3d0ec4e99aadd29.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 88
2⤵
- Program crash
PID:1492

memory/1492-54-0x0000000000000000-mapping.dmp

Download
memory/1940-55-0x0000000000400000-0x0000000000543000-memory.dmp

Filesize
1.3MB

Download