0086069f4d17825c9b05d2c189a115100b1bd9745432c7943288dc34b08ecbe9

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:58

Target

0086069f4d17825c9b05d2c189a115100b1bd9745432c7943288dc34b08ecbe9.exe
Size

110KB
MD5

765e823801c77b511a4d0031586a3263
SHA1

a22894c5bfdc45c25ca567aeb1548c16b62bde2b
SHA256

0086069f4d17825c9b05d2c189a115100b1bd9745432c7943288dc34b08ecbe9
SHA512

10e62285e79321f4b7757e06c4167c6fdb2f4b2f93fed38863f567dddd922741aff18bcb8befc8d56987c4da9b90197d433f086496802e256c436a266ac12b58
SSDEEP

1536:Tj5HFRJpyS7H+IYNKznIzQP8GABAF55utcm1R33w8ukSoSY+A37feaCMJDmYsLIv:vpyQIuHoS5Yt3XBSDADeak7dJHB/Az

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1528 1460 WerFault.exe 0086069f4d17825c9b05d2c189a115100b1bd9745432c7943288dc34b08ecbe9.exe

pid	pid_target	process	target process
1528	1460	WerFault.exe	0086069f4d17825c9b05d2c189a115100b1bd9745432c7943288dc34b08ecbe9.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0086069f4d17825c9b05d2c189a115100b1bd9745432c7943288dc34b08ecbe9.exe

description	pid	process	target process
PID 1460 wrote to memory of 1528	1460	0086069f4d17825c9b05d2c189a115100b1bd9745432c7943288dc34b08ecbe9.exe	WerFault.exe
PID 1460 wrote to memory of 1528	1460	0086069f4d17825c9b05d2c189a115100b1bd9745432c7943288dc34b08ecbe9.exe	WerFault.exe
PID 1460 wrote to memory of 1528	1460	0086069f4d17825c9b05d2c189a115100b1bd9745432c7943288dc34b08ecbe9.exe	WerFault.exe
PID 1460 wrote to memory of 1528	1460	0086069f4d17825c9b05d2c189a115100b1bd9745432c7943288dc34b08ecbe9.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0086069f4d17825c9b05d2c189a115100b1bd9745432c7943288dc34b08ecbe9.exe
"C:\Users\Admin\AppData\Local\Temp\0086069f4d17825c9b05d2c189a115100b1bd9745432c7943288dc34b08ecbe9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 176
2⤵
- Program crash
PID:1528

memory/1460-54-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/1460-56-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1528-55-0x0000000000000000-mapping.dmp

Download