4223936b9217a3f798b8f535ce2928a8b6d78078df29c351dd5de285d316dfde

Analysis

max time kernel
26s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:08

Target

4223936b9217a3f798b8f535ce2928a8b6d78078df29c351dd5de285d316dfde.exe
Size

784KB
MD5

48ec6135257ff976c8292f61d3f64ae0
SHA1

625d22a8a01f00eeb1b7b15e499720e4217889fe
SHA256

4223936b9217a3f798b8f535ce2928a8b6d78078df29c351dd5de285d316dfde
SHA512

e5b44c5b01873b3bc6deaf84d9b9bb8c2ecfbf8937d2b89b29758b2731083f2ce101ea08706c555d653b2e2a08581f295ba76c7823389f3981f5dcc23d6a438a
SSDEEP

12288:tPbZHk+/XY9AWxLXqs76ve7I+Lkk+/XY9AWxLXqs76ve7I+L:tPlHDMAWVR76v95DMAWVR76v9

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1152 1348 WerFault.exe 4223936b9217a3f798b8f535ce2928a8b6d78078df29c351dd5de285d316dfde.exe

pid	pid_target	process	target process
1152	1348	WerFault.exe	4223936b9217a3f798b8f535ce2928a8b6d78078df29c351dd5de285d316dfde.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4223936b9217a3f798b8f535ce2928a8b6d78078df29c351dd5de285d316dfde.exe

description	pid	process	target process
PID 1348 wrote to memory of 1152	1348	4223936b9217a3f798b8f535ce2928a8b6d78078df29c351dd5de285d316dfde.exe	WerFault.exe
PID 1348 wrote to memory of 1152	1348	4223936b9217a3f798b8f535ce2928a8b6d78078df29c351dd5de285d316dfde.exe	WerFault.exe
PID 1348 wrote to memory of 1152	1348	4223936b9217a3f798b8f535ce2928a8b6d78078df29c351dd5de285d316dfde.exe	WerFault.exe
PID 1348 wrote to memory of 1152	1348	4223936b9217a3f798b8f535ce2928a8b6d78078df29c351dd5de285d316dfde.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4223936b9217a3f798b8f535ce2928a8b6d78078df29c351dd5de285d316dfde.exe
"C:\Users\Admin\AppData\Local\Temp\4223936b9217a3f798b8f535ce2928a8b6d78078df29c351dd5de285d316dfde.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 92
2⤵
- Program crash
PID:1152

memory/1152-54-0x0000000000000000-mapping.dmp

Download
memory/1348-55-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download