01f4f4af0baabbbcbe304205ae8af0ce63c6dd9fcd6c74f7ec9bed2ed010c84c

Analysis

max time kernel
20s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:01

Target

01f4f4af0baabbbcbe304205ae8af0ce63c6dd9fcd6c74f7ec9bed2ed010c84c.exe
Size

33KB
MD5

451192a62f73f419047518dc6a467770
SHA1

67cd83b036e29d8759814e32c431f567064ee609
SHA256

01f4f4af0baabbbcbe304205ae8af0ce63c6dd9fcd6c74f7ec9bed2ed010c84c
SHA512

285783bb70d344db81a1c8e4311cbc94820731a079be36beb3cbb57fbdd686583e7c02169ce6bccefa53d8254858c8c8764ea4963bcb7a30fe13127c93d6db5d
SSDEEP

768:EVxE3Dtst1QPatqlM6niTdfk/qf4rqjcIMXX:iQQ1QDjniTdb4rBIMXX

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

956 996 WerFault.exe 01f4f4af0baabbbcbe304205ae8af0ce63c6dd9fcd6c74f7ec9bed2ed010c84c.exe

pid	pid_target	process	target process
956	996	WerFault.exe	01f4f4af0baabbbcbe304205ae8af0ce63c6dd9fcd6c74f7ec9bed2ed010c84c.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

01f4f4af0baabbbcbe304205ae8af0ce63c6dd9fcd6c74f7ec9bed2ed010c84c.exe

description	pid	process	target process
PID 996 wrote to memory of 956	996	01f4f4af0baabbbcbe304205ae8af0ce63c6dd9fcd6c74f7ec9bed2ed010c84c.exe	WerFault.exe
PID 996 wrote to memory of 956	996	01f4f4af0baabbbcbe304205ae8af0ce63c6dd9fcd6c74f7ec9bed2ed010c84c.exe	WerFault.exe
PID 996 wrote to memory of 956	996	01f4f4af0baabbbcbe304205ae8af0ce63c6dd9fcd6c74f7ec9bed2ed010c84c.exe	WerFault.exe
PID 996 wrote to memory of 956	996	01f4f4af0baabbbcbe304205ae8af0ce63c6dd9fcd6c74f7ec9bed2ed010c84c.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\01f4f4af0baabbbcbe304205ae8af0ce63c6dd9fcd6c74f7ec9bed2ed010c84c.exe
"C:\Users\Admin\AppData\Local\Temp\01f4f4af0baabbbcbe304205ae8af0ce63c6dd9fcd6c74f7ec9bed2ed010c84c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 188
2⤵
- Program crash
PID:956

memory/956-55-0x0000000000000000-mapping.dmp

Download
memory/996-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download