36762cef6205f5a038b626b568fefd52351bc6ccbc6ca84d6c589638abf8c514

Analysis

max time kernel
24s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:12

Target

36762cef6205f5a038b626b568fefd52351bc6ccbc6ca84d6c589638abf8c514.exe
Size

117KB
MD5

44a8513175c3940bcaf8464ad2b38c40
SHA1

58b70bcb66e06d0d6cc44e4e29e9736ebe052672
SHA256

36762cef6205f5a038b626b568fefd52351bc6ccbc6ca84d6c589638abf8c514
SHA512

7b22af6199c32f10ad0131df6f59fb766964490489641858c90b2453b2d0f4a54baf37369265325f8c7eb96bf58a26eeb9047c9bde5ef4f08e74fdc0980537ce
SSDEEP

3072:L3YQAhnEyLDBHqzvG7PJRXmobCpMQHWaq3BrtvfLO:j/AeGP5bCKA23nS

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

940 1336 WerFault.exe 36762cef6205f5a038b626b568fefd52351bc6ccbc6ca84d6c589638abf8c514.exe

pid	pid_target	process	target process
940	1336	WerFault.exe	36762cef6205f5a038b626b568fefd52351bc6ccbc6ca84d6c589638abf8c514.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

36762cef6205f5a038b626b568fefd52351bc6ccbc6ca84d6c589638abf8c514.exe

description	pid	process	target process
PID 1336 wrote to memory of 940	1336	36762cef6205f5a038b626b568fefd52351bc6ccbc6ca84d6c589638abf8c514.exe	WerFault.exe
PID 1336 wrote to memory of 940	1336	36762cef6205f5a038b626b568fefd52351bc6ccbc6ca84d6c589638abf8c514.exe	WerFault.exe
PID 1336 wrote to memory of 940	1336	36762cef6205f5a038b626b568fefd52351bc6ccbc6ca84d6c589638abf8c514.exe	WerFault.exe
PID 1336 wrote to memory of 940	1336	36762cef6205f5a038b626b568fefd52351bc6ccbc6ca84d6c589638abf8c514.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\36762cef6205f5a038b626b568fefd52351bc6ccbc6ca84d6c589638abf8c514.exe
"C:\Users\Admin\AppData\Local\Temp\36762cef6205f5a038b626b568fefd52351bc6ccbc6ca84d6c589638abf8c514.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 36
2⤵
- Program crash
PID:940

memory/940-55-0x0000000000000000-mapping.dmp

Download
memory/1336-54-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1336-56-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download