397ca428148a2ac1c1eb99d6a321b4d0f83b55e133b3e8e82d87337f63385571

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:50

Target

397ca428148a2ac1c1eb99d6a321b4d0f83b55e133b3e8e82d87337f63385571.exe
Size

74KB
MD5

1edc789d8d40e8b81c3f6cda0c971ab1
SHA1

7201c2421ccfdaecbdc4825ede4726577a2e795e
SHA256

397ca428148a2ac1c1eb99d6a321b4d0f83b55e133b3e8e82d87337f63385571
SHA512

a67caedbd280e067bf3c3e875da620849e45266bf6d12517b3e78fe1dbc655a0c5e7bdc4911fd6fda6924c1f369be0690bc3d2466582e9ed44fa8f4dc9b266c4
SSDEEP

1536:MkcznvvYUBdVdMq9Kxa3NdmkHGpHD+kTaZUNfaYy1rPjkh6:MkIvvHBpMq9Ks3N0fqcNfEw6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

888 1396 WerFault.exe 397ca428148a2ac1c1eb99d6a321b4d0f83b55e133b3e8e82d87337f63385571.exe

pid	pid_target	process	target process
888	1396	WerFault.exe	397ca428148a2ac1c1eb99d6a321b4d0f83b55e133b3e8e82d87337f63385571.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

397ca428148a2ac1c1eb99d6a321b4d0f83b55e133b3e8e82d87337f63385571.exe

description	pid	process	target process
PID 1396 wrote to memory of 888	1396	397ca428148a2ac1c1eb99d6a321b4d0f83b55e133b3e8e82d87337f63385571.exe	WerFault.exe
PID 1396 wrote to memory of 888	1396	397ca428148a2ac1c1eb99d6a321b4d0f83b55e133b3e8e82d87337f63385571.exe	WerFault.exe
PID 1396 wrote to memory of 888	1396	397ca428148a2ac1c1eb99d6a321b4d0f83b55e133b3e8e82d87337f63385571.exe	WerFault.exe
PID 1396 wrote to memory of 888	1396	397ca428148a2ac1c1eb99d6a321b4d0f83b55e133b3e8e82d87337f63385571.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\397ca428148a2ac1c1eb99d6a321b4d0f83b55e133b3e8e82d87337f63385571.exe
"C:\Users\Admin\AppData\Local\Temp\397ca428148a2ac1c1eb99d6a321b4d0f83b55e133b3e8e82d87337f63385571.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 96
2⤵
- Program crash
PID:888