4172f02d690e5121a17d3e763cc5190cf9dc7c8744d18b4237dcd52073714385

Analysis

max time kernel
36s
max time network
28s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 14:30

Target

4172f02d690e5121a17d3e763cc5190cf9dc7c8744d18b4237dcd52073714385.exe
Size

538KB
MD5

bc93d038b6599e092a5f3f94d873f1db
SHA1

686393337155bf9169c2ba07b4605e873810eda4
SHA256

4172f02d690e5121a17d3e763cc5190cf9dc7c8744d18b4237dcd52073714385
SHA512

436fa02d43ad65369e3a0f0d91dfe3bb28f876061cd62bca5555bb6f6080242b00eb3dd0817bbf4edf8065916177232267378b321490348c29a9d16029c1b8fa
SSDEEP

12288:ODPzaTr/Tlw3bTrn1Uhwtj0CpbsKvtstDGyAr+fAXBegGnsULHbz/:O7mHblwvxUhwt4ChJvtsQKAxegGnsabb

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

616 1620 WerFault.exe 4172f02d690e5121a17d3e763cc5190cf9dc7c8744d18b4237dcd52073714385.exe

pid	pid_target	process	target process
616	1620	WerFault.exe	4172f02d690e5121a17d3e763cc5190cf9dc7c8744d18b4237dcd52073714385.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4172f02d690e5121a17d3e763cc5190cf9dc7c8744d18b4237dcd52073714385.exe

description	pid	process	target process
PID 1620 wrote to memory of 616	1620	4172f02d690e5121a17d3e763cc5190cf9dc7c8744d18b4237dcd52073714385.exe	WerFault.exe
PID 1620 wrote to memory of 616	1620	4172f02d690e5121a17d3e763cc5190cf9dc7c8744d18b4237dcd52073714385.exe	WerFault.exe
PID 1620 wrote to memory of 616	1620	4172f02d690e5121a17d3e763cc5190cf9dc7c8744d18b4237dcd52073714385.exe	WerFault.exe
PID 1620 wrote to memory of 616	1620	4172f02d690e5121a17d3e763cc5190cf9dc7c8744d18b4237dcd52073714385.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4172f02d690e5121a17d3e763cc5190cf9dc7c8744d18b4237dcd52073714385.exe
"C:\Users\Admin\AppData\Local\Temp\4172f02d690e5121a17d3e763cc5190cf9dc7c8744d18b4237dcd52073714385.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 68
2⤵
- Program crash
PID:616