57e4cca21dbbcb20d989243af2df17f97e272e6b731f9c0fb1cd6addb6463d65

Analysis

max time kernel
40s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:56

Target

57e4cca21dbbcb20d989243af2df17f97e272e6b731f9c0fb1cd6addb6463d65.exe
Size

43KB
MD5

43910ed821f0b2e5f9c442dd78671cd0
SHA1

97724d44429b16042e6326fe73950392d6fb1805
SHA256

57e4cca21dbbcb20d989243af2df17f97e272e6b731f9c0fb1cd6addb6463d65
SHA512

bdd5189571e8d8d7d2cc3e3b6e90055d1d8e5df623ce0843c365f18f981cab011f21e45a18f6d18e601554b79837af9a939fbfc57e7d9b56ef08834b93405adb
SSDEEP

384:GfcrdBJIAK/yOYKBxsMVyFgOKyfI0FZ/TsXctOBwl4JgftY0jFssAvtoNdk:GfMBOYKBG8QmkIi/rOBwl4JqUloN2

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1172 1824 WerFault.exe 57e4cca21dbbcb20d989243af2df17f97e272e6b731f9c0fb1cd6addb6463d65.exe

pid	pid_target	process	target process
1172	1824	WerFault.exe	57e4cca21dbbcb20d989243af2df17f97e272e6b731f9c0fb1cd6addb6463d65.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

57e4cca21dbbcb20d989243af2df17f97e272e6b731f9c0fb1cd6addb6463d65.exe

description	pid	process	target process
PID 1824 wrote to memory of 1172	1824	57e4cca21dbbcb20d989243af2df17f97e272e6b731f9c0fb1cd6addb6463d65.exe	WerFault.exe
PID 1824 wrote to memory of 1172	1824	57e4cca21dbbcb20d989243af2df17f97e272e6b731f9c0fb1cd6addb6463d65.exe	WerFault.exe
PID 1824 wrote to memory of 1172	1824	57e4cca21dbbcb20d989243af2df17f97e272e6b731f9c0fb1cd6addb6463d65.exe	WerFault.exe
PID 1824 wrote to memory of 1172	1824	57e4cca21dbbcb20d989243af2df17f97e272e6b731f9c0fb1cd6addb6463d65.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\57e4cca21dbbcb20d989243af2df17f97e272e6b731f9c0fb1cd6addb6463d65.exe
"C:\Users\Admin\AppData\Local\Temp\57e4cca21dbbcb20d989243af2df17f97e272e6b731f9c0fb1cd6addb6463d65.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 36
2⤵
- Program crash
PID:1172