ca10e7eb124caef714f366a5c09d5536008520ee8cf542b5d1b68106c824115d

Analysis

max time kernel
7s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 19:04

Target

ca10e7eb124caef714f366a5c09d5536008520ee8cf542b5d1b68106c824115d.exe
Size

228KB
MD5

53b7e895db4d34c629041f00a9a1da30
SHA1

774d4f3857c12197c7d5a459ff66318601a8a7c7
SHA256

ca10e7eb124caef714f366a5c09d5536008520ee8cf542b5d1b68106c824115d
SHA512

15a8abd9b56c66dd7794a493a571e9005bead730868263debd059c69d7e246d176856ad115d0b18995d2895bd6339d47546e95e07204ea96ae756cce4a8a18dd
SSDEEP

6144:pV/1ZRf5rBItdiNIvpZmGZOvhqmySDTEid:pV/1ff56dxTrSDTE0

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

892 932 WerFault.exe ca10e7eb124caef714f366a5c09d5536008520ee8cf542b5d1b68106c824115d.exe

pid	pid_target	process	target process
892	932	WerFault.exe	ca10e7eb124caef714f366a5c09d5536008520ee8cf542b5d1b68106c824115d.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ca10e7eb124caef714f366a5c09d5536008520ee8cf542b5d1b68106c824115d.exe

description	pid	process	target process
PID 932 wrote to memory of 892	932	ca10e7eb124caef714f366a5c09d5536008520ee8cf542b5d1b68106c824115d.exe	WerFault.exe
PID 932 wrote to memory of 892	932	ca10e7eb124caef714f366a5c09d5536008520ee8cf542b5d1b68106c824115d.exe	WerFault.exe
PID 932 wrote to memory of 892	932	ca10e7eb124caef714f366a5c09d5536008520ee8cf542b5d1b68106c824115d.exe	WerFault.exe
PID 932 wrote to memory of 892	932	ca10e7eb124caef714f366a5c09d5536008520ee8cf542b5d1b68106c824115d.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ca10e7eb124caef714f366a5c09d5536008520ee8cf542b5d1b68106c824115d.exe
"C:\Users\Admin\AppData\Local\Temp\ca10e7eb124caef714f366a5c09d5536008520ee8cf542b5d1b68106c824115d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 72
2⤵
- Program crash
PID:892

memory/892-54-0x0000000000000000-mapping.dmp

Download
memory/932-55-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download