87d637730d2f40769523ed590c55de2b7be8e869564cd276798a6b2af57138a2

Analysis

max time kernel
35s
max time network
39s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:06

Target

87d637730d2f40769523ed590c55de2b7be8e869564cd276798a6b2af57138a2.exe
Size

257KB
MD5

26fdec74df444af24f7f9ac7b454e98f
SHA1

d80ea7a7ae3f32d0813755d060dff383ac9e3efa
SHA256

87d637730d2f40769523ed590c55de2b7be8e869564cd276798a6b2af57138a2
SHA512

9cb7d6675dc9e03cdd68df7ce468bf213479b46f9deb2e0a39b523c14b934ac01b426132c0eceb0628a4f1acdf221724170c2b2335557c189398983e9c5f3883
SSDEEP

3072:GkR8h6hDaAyQIrZBbSJKJEIFUhASSknv7BYJlQXQ8p6gD73yQIAcC/Bu76hLy:GkR8h6lpYZJtU7hCJCpp6gD7PXq2y

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1960 1488 WerFault.exe 87d637730d2f40769523ed590c55de2b7be8e869564cd276798a6b2af57138a2.exe

pid	pid_target	process	target process
1960	1488	WerFault.exe	87d637730d2f40769523ed590c55de2b7be8e869564cd276798a6b2af57138a2.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

87d637730d2f40769523ed590c55de2b7be8e869564cd276798a6b2af57138a2.exe

description	pid	process	target process
PID 1488 wrote to memory of 1960	1488	87d637730d2f40769523ed590c55de2b7be8e869564cd276798a6b2af57138a2.exe	WerFault.exe
PID 1488 wrote to memory of 1960	1488	87d637730d2f40769523ed590c55de2b7be8e869564cd276798a6b2af57138a2.exe	WerFault.exe
PID 1488 wrote to memory of 1960	1488	87d637730d2f40769523ed590c55de2b7be8e869564cd276798a6b2af57138a2.exe	WerFault.exe
PID 1488 wrote to memory of 1960	1488	87d637730d2f40769523ed590c55de2b7be8e869564cd276798a6b2af57138a2.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\87d637730d2f40769523ed590c55de2b7be8e869564cd276798a6b2af57138a2.exe
"C:\Users\Admin\AppData\Local\Temp\87d637730d2f40769523ed590c55de2b7be8e869564cd276798a6b2af57138a2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 116
2⤵
- Program crash
PID:1960

memory/1488-54-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download
memory/1488-56-0x00000000013B0000-0x00000000013CC000-memory.dmp

Filesize
112KB

Download
memory/1960-55-0x0000000000000000-mapping.dmp

Download