00497297e30673fe416fd8b03574c33b728933c80c32cd0871131ef12aed4f50

Analysis

max time kernel
93s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 19:05

Target

00497297e30673fe416fd8b03574c33b728933c80c32cd0871131ef12aed4f50.exe
Size

320KB
MD5

52329f2f057d172c094efd853a44e100
SHA1

a81be9e9a19f396a77f9acea1e026441d1426920
SHA256

00497297e30673fe416fd8b03574c33b728933c80c32cd0871131ef12aed4f50
SHA512

4411918c52c80820bac910424368d7ffef13915eb2b7980688403262a45fce35d72e843e73306f4f895b4ddd81ff454c522f8cc7657dcf802c5d327564a653db
SSDEEP

6144:MiFa2kFOgQUD//KGQLkz7/JXLl+DJoTBq5R50dqOMmqMfy7tsqbSsQLH5AS:MiQXFOeD//KzLkvxXLl+DJoTs5RWPqMR

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1792 752 WerFault.exe 00497297e30673fe416fd8b03574c33b728933c80c32cd0871131ef12aed4f50.exe

pid	pid_target	process	target process
1792	752	WerFault.exe	00497297e30673fe416fd8b03574c33b728933c80c32cd0871131ef12aed4f50.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

00497297e30673fe416fd8b03574c33b728933c80c32cd0871131ef12aed4f50.exe

description	pid	process	target process
PID 752 wrote to memory of 1792	752	00497297e30673fe416fd8b03574c33b728933c80c32cd0871131ef12aed4f50.exe	WerFault.exe
PID 752 wrote to memory of 1792	752	00497297e30673fe416fd8b03574c33b728933c80c32cd0871131ef12aed4f50.exe	WerFault.exe
PID 752 wrote to memory of 1792	752	00497297e30673fe416fd8b03574c33b728933c80c32cd0871131ef12aed4f50.exe	WerFault.exe
PID 752 wrote to memory of 1792	752	00497297e30673fe416fd8b03574c33b728933c80c32cd0871131ef12aed4f50.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\00497297e30673fe416fd8b03574c33b728933c80c32cd0871131ef12aed4f50.exe
"C:\Users\Admin\AppData\Local\Temp\00497297e30673fe416fd8b03574c33b728933c80c32cd0871131ef12aed4f50.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 200
2⤵
- Program crash
PID:1792

memory/752-54-0x0000000074ED1000-0x0000000074ED3000-memory.dmp

Filesize
8KB

Download
memory/752-56-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1792-55-0x0000000000000000-mapping.dmp

Download