bd49d153530dbee73db3d5ec899c714b93f68a1027234948b222cfa8ed915d45

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:13

Target

bd49d153530dbee73db3d5ec899c714b93f68a1027234948b222cfa8ed915d45.exe
Size

94KB
MD5

f08df0a2a6c6c8af1313a21af592d05d
SHA1

5c2875c2196dc5d238ff9971afde2a1ebd8f6481
SHA256

bd49d153530dbee73db3d5ec899c714b93f68a1027234948b222cfa8ed915d45
SHA512

8e2b178c8553a3f8ce7c236a82421ae9644b81740c445c9499221223562526a94f6f1fbd644cc785796e1e0233756b898a736baf00a87a292a9f29ebc6f01264
SSDEEP

1536:UI8Z+DT6Y8C8HFs0O7BLjMQcF8yscK4F+WxAU2IsDydpBIOv+RuazGwr:wZeTV8VUwQg8sK8+UAUCydp/QuU

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

684 1428 WerFault.exe bd49d153530dbee73db3d5ec899c714b93f68a1027234948b222cfa8ed915d45.exe

pid	pid_target	process	target process
684	1428	WerFault.exe	bd49d153530dbee73db3d5ec899c714b93f68a1027234948b222cfa8ed915d45.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bd49d153530dbee73db3d5ec899c714b93f68a1027234948b222cfa8ed915d45.exe

description	pid	process	target process
PID 1428 wrote to memory of 684	1428	bd49d153530dbee73db3d5ec899c714b93f68a1027234948b222cfa8ed915d45.exe	WerFault.exe
PID 1428 wrote to memory of 684	1428	bd49d153530dbee73db3d5ec899c714b93f68a1027234948b222cfa8ed915d45.exe	WerFault.exe
PID 1428 wrote to memory of 684	1428	bd49d153530dbee73db3d5ec899c714b93f68a1027234948b222cfa8ed915d45.exe	WerFault.exe
PID 1428 wrote to memory of 684	1428	bd49d153530dbee73db3d5ec899c714b93f68a1027234948b222cfa8ed915d45.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bd49d153530dbee73db3d5ec899c714b93f68a1027234948b222cfa8ed915d45.exe
"C:\Users\Admin\AppData\Local\Temp\bd49d153530dbee73db3d5ec899c714b93f68a1027234948b222cfa8ed915d45.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 88
2⤵
- Program crash
PID:684

memory/684-54-0x0000000000000000-mapping.dmp

Download
memory/1428-55-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download