154b4e55ce1d8ded53d9ab935f83e415c70deb7e02ed81fdbd49a066a3691fa5

Analysis

max time kernel
31s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 19:04

Target

154b4e55ce1d8ded53d9ab935f83e415c70deb7e02ed81fdbd49a066a3691fa5.exe
Size

144KB
MD5

50a8eec99190d235a4b8e3acb775d720
SHA1

806a0c57389af673ecbeb72d7e99e05de739afb9
SHA256

154b4e55ce1d8ded53d9ab935f83e415c70deb7e02ed81fdbd49a066a3691fa5
SHA512

39db5bffc7e1e4f16d6357e2ba3e5e58cbc43dda93ac0e7a6569b9195c342d0255445089f4532bf6ba1d4c9e358d8be9883bc72a2033fb2d23e0901a29652c14
SSDEEP

3072:oR8o3Ci/c5LuZjXgIkag0gvs3bgg2xGnRbND:w/c5LuZkI/UGbgg2xC1

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1372 1328 WerFault.exe 154b4e55ce1d8ded53d9ab935f83e415c70deb7e02ed81fdbd49a066a3691fa5.exe

pid	pid_target	process	target process
1372	1328	WerFault.exe	154b4e55ce1d8ded53d9ab935f83e415c70deb7e02ed81fdbd49a066a3691fa5.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

154b4e55ce1d8ded53d9ab935f83e415c70deb7e02ed81fdbd49a066a3691fa5.exe

description	pid	process	target process
PID 1328 wrote to memory of 1372	1328	154b4e55ce1d8ded53d9ab935f83e415c70deb7e02ed81fdbd49a066a3691fa5.exe	WerFault.exe
PID 1328 wrote to memory of 1372	1328	154b4e55ce1d8ded53d9ab935f83e415c70deb7e02ed81fdbd49a066a3691fa5.exe	WerFault.exe
PID 1328 wrote to memory of 1372	1328	154b4e55ce1d8ded53d9ab935f83e415c70deb7e02ed81fdbd49a066a3691fa5.exe	WerFault.exe
PID 1328 wrote to memory of 1372	1328	154b4e55ce1d8ded53d9ab935f83e415c70deb7e02ed81fdbd49a066a3691fa5.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\154b4e55ce1d8ded53d9ab935f83e415c70deb7e02ed81fdbd49a066a3691fa5.exe
"C:\Users\Admin\AppData\Local\Temp\154b4e55ce1d8ded53d9ab935f83e415c70deb7e02ed81fdbd49a066a3691fa5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 148
2⤵
- Program crash
PID:1372

memory/1328-55-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1372-54-0x0000000000000000-mapping.dmp

Download