0f2346355c896ab2a262af4585e2d76ce3e4b8b67904d7872e5a5889a65a3a8f

Analysis

max time kernel
81s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 16:56

Target

0f2346355c896ab2a262af4585e2d76ce3e4b8b67904d7872e5a5889a65a3a8f.exe
Size

356KB
MD5

52ac17cfac3ea3fd761f5d9ba67e3f70
SHA1

19e2a246ec2ae8f57f65ae27ba8a99f197e61e31
SHA256

0f2346355c896ab2a262af4585e2d76ce3e4b8b67904d7872e5a5889a65a3a8f
SHA512

1ea7f97952a45efedfa3e38ade378f3cfa1d7585c1ed1cb60fd0f33106d0a398782ff799403b46aeb928b8eff8afbfc58059151edd2566a679b96f185f830114
SSDEEP

6144:8g27CHbEH4s/0oOerJlvLryvT2HopOUpzo0naGR:8feoH4sMoOe1ljryvrYQPaGR

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1668 668 WerFault.exe 0f2346355c896ab2a262af4585e2d76ce3e4b8b67904d7872e5a5889a65a3a8f.exe

pid	pid_target	process	target process
1668	668	WerFault.exe	0f2346355c896ab2a262af4585e2d76ce3e4b8b67904d7872e5a5889a65a3a8f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0f2346355c896ab2a262af4585e2d76ce3e4b8b67904d7872e5a5889a65a3a8f.exe

description	pid	process	target process
PID 668 wrote to memory of 1668	668	0f2346355c896ab2a262af4585e2d76ce3e4b8b67904d7872e5a5889a65a3a8f.exe	WerFault.exe
PID 668 wrote to memory of 1668	668	0f2346355c896ab2a262af4585e2d76ce3e4b8b67904d7872e5a5889a65a3a8f.exe	WerFault.exe
PID 668 wrote to memory of 1668	668	0f2346355c896ab2a262af4585e2d76ce3e4b8b67904d7872e5a5889a65a3a8f.exe	WerFault.exe
PID 668 wrote to memory of 1668	668	0f2346355c896ab2a262af4585e2d76ce3e4b8b67904d7872e5a5889a65a3a8f.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0f2346355c896ab2a262af4585e2d76ce3e4b8b67904d7872e5a5889a65a3a8f.exe
"C:\Users\Admin\AppData\Local\Temp\0f2346355c896ab2a262af4585e2d76ce3e4b8b67904d7872e5a5889a65a3a8f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 196
2⤵
- Program crash
PID:1668

memory/668-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/668-56-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1668-55-0x0000000000000000-mapping.dmp

Download