146971b949f571f413f042a62e761fd74e1c9aec2887d07cdd3c372791731ab2

Analysis

max time kernel
8s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:49

Target

146971b949f571f413f042a62e761fd74e1c9aec2887d07cdd3c372791731ab2.exe
Size

210KB
MD5

275746bee19403a4ac8eb536db1dd30f
SHA1

546c90fa672172a7a7946cc5fd7eb42cb992131b
SHA256

146971b949f571f413f042a62e761fd74e1c9aec2887d07cdd3c372791731ab2
SHA512

c3c6de5dd783b79bfa1ac17d0e313b8cbb5278be77ef1c8216359975d10cb374e8f6fce17b10e00bbe7b300a756ee2e65810d0e113251d0469237a0ea96dd6d2
SSDEEP

6144:Av4aVC1sHJx523ibO1AQ4ttsgYlWJk0+8dei0i:qCKHJx523K5lk0Zei0i

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

536 1780 WerFault.exe 146971b949f571f413f042a62e761fd74e1c9aec2887d07cdd3c372791731ab2.exe

pid	pid_target	process	target process
536	1780	WerFault.exe	146971b949f571f413f042a62e761fd74e1c9aec2887d07cdd3c372791731ab2.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

146971b949f571f413f042a62e761fd74e1c9aec2887d07cdd3c372791731ab2.exe

description	pid	process	target process
PID 1780 wrote to memory of 536	1780	146971b949f571f413f042a62e761fd74e1c9aec2887d07cdd3c372791731ab2.exe	WerFault.exe
PID 1780 wrote to memory of 536	1780	146971b949f571f413f042a62e761fd74e1c9aec2887d07cdd3c372791731ab2.exe	WerFault.exe
PID 1780 wrote to memory of 536	1780	146971b949f571f413f042a62e761fd74e1c9aec2887d07cdd3c372791731ab2.exe	WerFault.exe
PID 1780 wrote to memory of 536	1780	146971b949f571f413f042a62e761fd74e1c9aec2887d07cdd3c372791731ab2.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\146971b949f571f413f042a62e761fd74e1c9aec2887d07cdd3c372791731ab2.exe
"C:\Users\Admin\AppData\Local\Temp\146971b949f571f413f042a62e761fd74e1c9aec2887d07cdd3c372791731ab2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 128
  2⤵
  - Program crash
  PID:536

memory/536-54-0x0000000000000000-mapping.dmp

Download
memory/1780-55-0x000000002FB80000-0x000000002FBB6000-memory.dmp

Filesize
216KB

Download