c071a1892f1429812ec91aeb825baea9d80fb26044d15d3d575e2fa66335f411

Analysis

max time kernel
3s
max time network
186s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 16:40

Target

c071a1892f1429812ec91aeb825baea9d80fb26044d15d3d575e2fa66335f411.exe
Size

132KB
MD5

4301f95ccde79b17532c507874535cf0
SHA1

4092704e7fa81befcbe9d56359bde3014c3f7ac0
SHA256

c071a1892f1429812ec91aeb825baea9d80fb26044d15d3d575e2fa66335f411
SHA512

bf61be44e38314d0ade660870e01564cb2d8b01866e7eca53695798f559f2463ea99fa8b08322e984a8b18f3aa706526e0704f77bf7c593cb86c74900ce10de6
SSDEEP

3072:n0GnBLfORThFfOUBGrFSDADeak7dJHB/A5:08BL2RTv2UB6FSsQLH5A5

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1396 1232 WerFault.exe c071a1892f1429812ec91aeb825baea9d80fb26044d15d3d575e2fa66335f411.exe

pid	pid_target	process	target process
1396	1232	WerFault.exe	c071a1892f1429812ec91aeb825baea9d80fb26044d15d3d575e2fa66335f411.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c071a1892f1429812ec91aeb825baea9d80fb26044d15d3d575e2fa66335f411.exe

description	pid	process	target process
PID 1232 wrote to memory of 1396	1232	c071a1892f1429812ec91aeb825baea9d80fb26044d15d3d575e2fa66335f411.exe	WerFault.exe
PID 1232 wrote to memory of 1396	1232	c071a1892f1429812ec91aeb825baea9d80fb26044d15d3d575e2fa66335f411.exe	WerFault.exe
PID 1232 wrote to memory of 1396	1232	c071a1892f1429812ec91aeb825baea9d80fb26044d15d3d575e2fa66335f411.exe	WerFault.exe
PID 1232 wrote to memory of 1396	1232	c071a1892f1429812ec91aeb825baea9d80fb26044d15d3d575e2fa66335f411.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c071a1892f1429812ec91aeb825baea9d80fb26044d15d3d575e2fa66335f411.exe
"C:\Users\Admin\AppData\Local\Temp\c071a1892f1429812ec91aeb825baea9d80fb26044d15d3d575e2fa66335f411.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 148
  2⤵
  - Program crash
  PID:1396

memory/1232-54-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1396-55-0x0000000000000000-mapping.dmp

Download