1f0a209da06b1a75e1ab1c7e2e11d2b61c2b8ca3871ecc93ef487d004d281e03

Analysis

max time kernel
19s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 19:10

Target

1f0a209da06b1a75e1ab1c7e2e11d2b61c2b8ca3871ecc93ef487d004d281e03.exe
Size

1.6MB
MD5

96c3d69608882152ec828540cb2115b7
SHA1

68d4f7a8eb6eec1e8eadaeb6a939b07ce6f5ea76
SHA256

1f0a209da06b1a75e1ab1c7e2e11d2b61c2b8ca3871ecc93ef487d004d281e03
SHA512

f638a0bed1972bf7a1886f3c9a12f33cd1a84cb83aa6580127e87dc37a16e8921d0c951081b4667c5e9a521bb97a81f91a75b02d58804c6f0180dbfc9120a4e4
SSDEEP

24576:+8B14u8XkMt1Y1xthCLubCcmkw4Zbv2Z7ZVIzOPuZCvUC7KChfgXYCqsYgXY1:dlGlSXZCvh7K9C

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

932 1776 WerFault.exe 1f0a209da06b1a75e1ab1c7e2e11d2b61c2b8ca3871ecc93ef487d004d281e03.exe

pid	pid_target	process	target process
932	1776	WerFault.exe	1f0a209da06b1a75e1ab1c7e2e11d2b61c2b8ca3871ecc93ef487d004d281e03.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1f0a209da06b1a75e1ab1c7e2e11d2b61c2b8ca3871ecc93ef487d004d281e03.exe

description	pid	process	target process
PID 1776 wrote to memory of 932	1776	1f0a209da06b1a75e1ab1c7e2e11d2b61c2b8ca3871ecc93ef487d004d281e03.exe	WerFault.exe
PID 1776 wrote to memory of 932	1776	1f0a209da06b1a75e1ab1c7e2e11d2b61c2b8ca3871ecc93ef487d004d281e03.exe	WerFault.exe
PID 1776 wrote to memory of 932	1776	1f0a209da06b1a75e1ab1c7e2e11d2b61c2b8ca3871ecc93ef487d004d281e03.exe	WerFault.exe
PID 1776 wrote to memory of 932	1776	1f0a209da06b1a75e1ab1c7e2e11d2b61c2b8ca3871ecc93ef487d004d281e03.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1f0a209da06b1a75e1ab1c7e2e11d2b61c2b8ca3871ecc93ef487d004d281e03.exe
"C:\Users\Admin\AppData\Local\Temp\1f0a209da06b1a75e1ab1c7e2e11d2b61c2b8ca3871ecc93ef487d004d281e03.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 664
2⤵
- Program crash
PID:932

memory/932-56-0x0000000000000000-mapping.dmp

Download
memory/1776-54-0x0000000001140000-0x00000000012E8000-memory.dmp

Filesize
1.7MB

Download
memory/1776-55-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download