f943a9f69d23ab975da1bf3bfaff8deb36d24cf2f4154d7e8fd0eb51cae284cb

Analysis

max time kernel
244s
max time network
333s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:27

Target

f943a9f69d23ab975da1bf3bfaff8deb36d24cf2f4154d7e8fd0eb51cae284cb.exe
Size

100KB
MD5

0345912182be1123d877a0d6406b9242
SHA1

1661b3d100234e553745091be55bfb04ac6233b7
SHA256

f943a9f69d23ab975da1bf3bfaff8deb36d24cf2f4154d7e8fd0eb51cae284cb
SHA512

53bce875b85a1add9c84e83b27e795071882b08ca48b4b84e40db9ebf2ca61cb2bc984beede0302b0ac67d7632209ab2e214f83dcd86ba082ca0afe77bdf8206
SSDEEP

3072:ZeZU0FYw//m2iVw8htMdq949IV0iMjfG:ZeZ9Yw/eKtdnIV0iS+

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

852 1112 WerFault.exe f943a9f69d23ab975da1bf3bfaff8deb36d24cf2f4154d7e8fd0eb51cae284cb.exe

pid	pid_target	process	target process
852	1112	WerFault.exe	f943a9f69d23ab975da1bf3bfaff8deb36d24cf2f4154d7e8fd0eb51cae284cb.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f943a9f69d23ab975da1bf3bfaff8deb36d24cf2f4154d7e8fd0eb51cae284cb.exe

description	pid	process	target process
PID 1112 wrote to memory of 852	1112	f943a9f69d23ab975da1bf3bfaff8deb36d24cf2f4154d7e8fd0eb51cae284cb.exe	WerFault.exe
PID 1112 wrote to memory of 852	1112	f943a9f69d23ab975da1bf3bfaff8deb36d24cf2f4154d7e8fd0eb51cae284cb.exe	WerFault.exe
PID 1112 wrote to memory of 852	1112	f943a9f69d23ab975da1bf3bfaff8deb36d24cf2f4154d7e8fd0eb51cae284cb.exe	WerFault.exe
PID 1112 wrote to memory of 852	1112	f943a9f69d23ab975da1bf3bfaff8deb36d24cf2f4154d7e8fd0eb51cae284cb.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f943a9f69d23ab975da1bf3bfaff8deb36d24cf2f4154d7e8fd0eb51cae284cb.exe
"C:\Users\Admin\AppData\Local\Temp\f943a9f69d23ab975da1bf3bfaff8deb36d24cf2f4154d7e8fd0eb51cae284cb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 88
2⤵
- Program crash
PID:852