ba4afb5de2dd5dc739aeff5f631a3480f2fbd29e652e832efbef4b1aa06f0137

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:34

Target

ba4afb5de2dd5dc739aeff5f631a3480f2fbd29e652e832efbef4b1aa06f0137.exe
Size

588KB
MD5

e16b70b1511c14e0edc63915ce1644e6
SHA1

0161cf33e2b5411f60173716d532c13ed85b6ad3
SHA256

ba4afb5de2dd5dc739aeff5f631a3480f2fbd29e652e832efbef4b1aa06f0137
SHA512

b0db013a67eb9ec818b9c6e58ef6f6dad2a240001093338a93d72eb00e4f89e2310d12995113807ab538bd1ca0d64550614355c4afca45482228222e42a904b1
SSDEEP

6144:doJZ/3vvcwdPTWFoamGI17U0VIg93Z0EmBf+4Cfhok5ArnI+dwq7CiJzecD6h0Ey:ujhx95LWIJqG+rJ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

824 1380 WerFault.exe ba4afb5de2dd5dc739aeff5f631a3480f2fbd29e652e832efbef4b1aa06f0137.exe

pid	pid_target	process	target process
824	1380	WerFault.exe	ba4afb5de2dd5dc739aeff5f631a3480f2fbd29e652e832efbef4b1aa06f0137.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

ba4afb5de2dd5dc739aeff5f631a3480f2fbd29e652e832efbef4b1aa06f0137.exe

description	pid	process	target process
PID 1380 wrote to memory of 824	1380	ba4afb5de2dd5dc739aeff5f631a3480f2fbd29e652e832efbef4b1aa06f0137.exe	WerFault.exe
PID 1380 wrote to memory of 824	1380	ba4afb5de2dd5dc739aeff5f631a3480f2fbd29e652e832efbef4b1aa06f0137.exe	WerFault.exe
PID 1380 wrote to memory of 824	1380	ba4afb5de2dd5dc739aeff5f631a3480f2fbd29e652e832efbef4b1aa06f0137.exe	WerFault.exe
PID 1380 wrote to memory of 824	1380	ba4afb5de2dd5dc739aeff5f631a3480f2fbd29e652e832efbef4b1aa06f0137.exe	WerFault.exe
PID 1380 wrote to memory of 824	1380	ba4afb5de2dd5dc739aeff5f631a3480f2fbd29e652e832efbef4b1aa06f0137.exe	WerFault.exe
PID 1380 wrote to memory of 824	1380	ba4afb5de2dd5dc739aeff5f631a3480f2fbd29e652e832efbef4b1aa06f0137.exe	WerFault.exe
PID 1380 wrote to memory of 824	1380	ba4afb5de2dd5dc739aeff5f631a3480f2fbd29e652e832efbef4b1aa06f0137.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ba4afb5de2dd5dc739aeff5f631a3480f2fbd29e652e832efbef4b1aa06f0137.exe
"C:\Users\Admin\AppData\Local\Temp\ba4afb5de2dd5dc739aeff5f631a3480f2fbd29e652e832efbef4b1aa06f0137.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 324
  2⤵
  - Program crash
  PID:824

memory/824-55-0x0000000000000000-mapping.dmp

Download
memory/1380-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download