906bbd0da1b72f95b541acdabb08026b823ac0871f2d8011ef138228c9107a6d

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:57

Target

906bbd0da1b72f95b541acdabb08026b823ac0871f2d8011ef138228c9107a6d.exe
Size

339KB
MD5

5321a5fe0c244f01683c658f452130f0
SHA1

9d8fcaaf1be3127299e07f1cdf8ba215dd2f21a8
SHA256

906bbd0da1b72f95b541acdabb08026b823ac0871f2d8011ef138228c9107a6d
SHA512

bb12c337f1c9195d4b2e6d0c6ed083a6368b21955203d0e66446d0599df6d49fa43ab47e960c176355349185e046cc5a713da1844a070a2cdc8ecf515dc1e095
SSDEEP

6144:AzW/KFKNxY1pDFN0xVI7tRrKwyjg2ruu6rFxpSDg9SCN6Kr:CCxY1djSOBRrKwyjg+uxYUAy6Kr

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1624 1908 WerFault.exe 906bbd0da1b72f95b541acdabb08026b823ac0871f2d8011ef138228c9107a6d.exe

pid	pid_target	process	target process
1624	1908	WerFault.exe	906bbd0da1b72f95b541acdabb08026b823ac0871f2d8011ef138228c9107a6d.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

906bbd0da1b72f95b541acdabb08026b823ac0871f2d8011ef138228c9107a6d.exe

description	pid	process	target process
PID 1908 wrote to memory of 1624	1908	906bbd0da1b72f95b541acdabb08026b823ac0871f2d8011ef138228c9107a6d.exe	WerFault.exe
PID 1908 wrote to memory of 1624	1908	906bbd0da1b72f95b541acdabb08026b823ac0871f2d8011ef138228c9107a6d.exe	WerFault.exe
PID 1908 wrote to memory of 1624	1908	906bbd0da1b72f95b541acdabb08026b823ac0871f2d8011ef138228c9107a6d.exe	WerFault.exe
PID 1908 wrote to memory of 1624	1908	906bbd0da1b72f95b541acdabb08026b823ac0871f2d8011ef138228c9107a6d.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\906bbd0da1b72f95b541acdabb08026b823ac0871f2d8011ef138228c9107a6d.exe
"C:\Users\Admin\AppData\Local\Temp\906bbd0da1b72f95b541acdabb08026b823ac0871f2d8011ef138228c9107a6d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 116
2⤵
- Program crash
PID:1624

memory/1624-55-0x0000000000000000-mapping.dmp

Download
memory/1908-54-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1908-56-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download