84139c6079306b98f9429272615d0038efea37e48d2784e30bda00ddbc10d024

Analysis

max time kernel
92s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:15

Target

84139c6079306b98f9429272615d0038efea37e48d2784e30bda00ddbc10d024.exe
Size

200KB
MD5

451f9e46c1d72d59c131d10a5141e31c
SHA1

2d6dfebf442880f528b44703ef3140920b546dc2
SHA256

84139c6079306b98f9429272615d0038efea37e48d2784e30bda00ddbc10d024
SHA512

25d1b56b58faa068c1a53ed682ac38c8bd7dc4ef968199ec3b446c3c0543c2ea7adf84959a00e0e3d8aba255ff8d807700f19e53a0ef2c4078ff693702b84322
SSDEEP

3072:cKKb1edk0bT5ni+lRd4ESGf4Fv5NR2OnCW8DCUck/CJcd+F9UK/r1F2aTwXZg0by:cKKbZyNi+Rb6AaJkru99

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

580 1888 WerFault.exe 84139c6079306b98f9429272615d0038efea37e48d2784e30bda00ddbc10d024.exe

pid	pid_target	process	target process
580	1888	WerFault.exe	84139c6079306b98f9429272615d0038efea37e48d2784e30bda00ddbc10d024.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

84139c6079306b98f9429272615d0038efea37e48d2784e30bda00ddbc10d024.exe

description	pid	process	target process
PID 1888 wrote to memory of 580	1888	84139c6079306b98f9429272615d0038efea37e48d2784e30bda00ddbc10d024.exe	WerFault.exe
PID 1888 wrote to memory of 580	1888	84139c6079306b98f9429272615d0038efea37e48d2784e30bda00ddbc10d024.exe	WerFault.exe
PID 1888 wrote to memory of 580	1888	84139c6079306b98f9429272615d0038efea37e48d2784e30bda00ddbc10d024.exe	WerFault.exe
PID 1888 wrote to memory of 580	1888	84139c6079306b98f9429272615d0038efea37e48d2784e30bda00ddbc10d024.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\84139c6079306b98f9429272615d0038efea37e48d2784e30bda00ddbc10d024.exe
"C:\Users\Admin\AppData\Local\Temp\84139c6079306b98f9429272615d0038efea37e48d2784e30bda00ddbc10d024.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 124
2⤵
- Program crash
PID:580

memory/580-54-0x0000000000000000-mapping.dmp

Download
memory/1888-55-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download