fda3b396c195edd6f83ec170f25a5190de6eeeaaf55224572035575376914794

Analysis

max time kernel
40s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:13

Target

fda3b396c195edd6f83ec170f25a5190de6eeeaaf55224572035575376914794.exe
Size

201KB
MD5

5c3eb419e439d12c58de465cce5009f5
SHA1

da5a0c78deca98f912878125482e64519c3b5686
SHA256

fda3b396c195edd6f83ec170f25a5190de6eeeaaf55224572035575376914794
SHA512

5cc86d3efa91ce3b82293f7818a7b9e2d4b05b0e0bdd5c6cc7662302359b103a14db607a57c2573866dc7da204f73c9eb591931fb839516dfc42eadbc37fb2d6
SSDEEP

6144:X3IoSjsH4mmdHGPeN7Sy05iWYJuZhX/dRxnc5X+:XYoum1CmPq7SFiW1Z9VRxnc5O

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

880 1460 WerFault.exe fda3b396c195edd6f83ec170f25a5190de6eeeaaf55224572035575376914794.exe

pid	pid_target	process	target process
880	1460	WerFault.exe	fda3b396c195edd6f83ec170f25a5190de6eeeaaf55224572035575376914794.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fda3b396c195edd6f83ec170f25a5190de6eeeaaf55224572035575376914794.exe

description	pid	process	target process
PID 1460 wrote to memory of 880	1460	fda3b396c195edd6f83ec170f25a5190de6eeeaaf55224572035575376914794.exe	WerFault.exe
PID 1460 wrote to memory of 880	1460	fda3b396c195edd6f83ec170f25a5190de6eeeaaf55224572035575376914794.exe	WerFault.exe
PID 1460 wrote to memory of 880	1460	fda3b396c195edd6f83ec170f25a5190de6eeeaaf55224572035575376914794.exe	WerFault.exe
PID 1460 wrote to memory of 880	1460	fda3b396c195edd6f83ec170f25a5190de6eeeaaf55224572035575376914794.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fda3b396c195edd6f83ec170f25a5190de6eeeaaf55224572035575376914794.exe
"C:\Users\Admin\AppData\Local\Temp\fda3b396c195edd6f83ec170f25a5190de6eeeaaf55224572035575376914794.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 48
2⤵
- Program crash
PID:880

memory/880-54-0x0000000000000000-mapping.dmp

Download
memory/1460-55-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download