a13aaf19d47cc0037be83b537ca91c867bd77f83bce48d4798089ed807b6d417

Analysis

max time kernel
187s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:51

Target

a13aaf19d47cc0037be83b537ca91c867bd77f83bce48d4798089ed807b6d417.exe
Size

315KB
MD5

0307703ad0de4908cb4627c54c5f48fa
SHA1

41b4bd2e0f764e2c1ae6cabfb3af9aa2e0d58707
SHA256

a13aaf19d47cc0037be83b537ca91c867bd77f83bce48d4798089ed807b6d417
SHA512

e649666398491cda04b1dbb58437eddcc92f75edacc4185862576e8478e8dad5947c541b33d747b48117f72de951b4c5dc655dec2fcf2a29b05722cf2816dd7a
SSDEEP

6144:4ngbMSNWOtVlA+Uy+5r+Le3PfcKrKywEayZBmx4cNGIns8kT:4gwAWcAiWdGyDCxAInjU

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

876 1660 WerFault.exe a13aaf19d47cc0037be83b537ca91c867bd77f83bce48d4798089ed807b6d417.exe

pid	pid_target	process	target process
876	1660	WerFault.exe	a13aaf19d47cc0037be83b537ca91c867bd77f83bce48d4798089ed807b6d417.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a13aaf19d47cc0037be83b537ca91c867bd77f83bce48d4798089ed807b6d417.exe

description	pid	process	target process
PID 1660 wrote to memory of 876	1660	a13aaf19d47cc0037be83b537ca91c867bd77f83bce48d4798089ed807b6d417.exe	WerFault.exe
PID 1660 wrote to memory of 876	1660	a13aaf19d47cc0037be83b537ca91c867bd77f83bce48d4798089ed807b6d417.exe	WerFault.exe
PID 1660 wrote to memory of 876	1660	a13aaf19d47cc0037be83b537ca91c867bd77f83bce48d4798089ed807b6d417.exe	WerFault.exe
PID 1660 wrote to memory of 876	1660	a13aaf19d47cc0037be83b537ca91c867bd77f83bce48d4798089ed807b6d417.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a13aaf19d47cc0037be83b537ca91c867bd77f83bce48d4798089ed807b6d417.exe
"C:\Users\Admin\AppData\Local\Temp\a13aaf19d47cc0037be83b537ca91c867bd77f83bce48d4798089ed807b6d417.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 132
2⤵
- Program crash
PID:876

memory/876-56-0x0000000000000000-mapping.dmp

Download
memory/1660-54-0x0000000000F70000-0x0000000000FC2000-memory.dmp

Filesize
328KB

Download
memory/1660-55-0x0000000075441000-0x0000000075443000-memory.dmp

Filesize
8KB

Download
memory/1660-57-0x0000000000F70000-0x0000000000FC2000-memory.dmp

Filesize
328KB

Download