401a666ba4488c71e500922a216881fbeaae5e3387d8b65f25224a9f4f5f42c5

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:14

Target

401a666ba4488c71e500922a216881fbeaae5e3387d8b65f25224a9f4f5f42c5.exe
Size

177KB
MD5

435ec13a347e829f800a0cb3696f136f
SHA1

b7a9b181e594c94da42f615cc65ddda626462a8d
SHA256

401a666ba4488c71e500922a216881fbeaae5e3387d8b65f25224a9f4f5f42c5
SHA512

e845f1ed830cac4aff0844c1826240e357d463f6d5ab319f2f1a7e261279a233a431f31e6e61848ef0e8c7a3534091bd08db39010867b5663ff176d280aea453
SSDEEP

3072:6VY9gLTq81p3fIETxDq0YGdHSM6qWT5p6MXMp4g9elxvenxTTMs6trac:6WdipPIe2MdHSMXWT5NHYFDOra

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1216 1360 WerFault.exe 401a666ba4488c71e500922a216881fbeaae5e3387d8b65f25224a9f4f5f42c5.exe

pid	pid_target	process	target process
1216	1360	WerFault.exe	401a666ba4488c71e500922a216881fbeaae5e3387d8b65f25224a9f4f5f42c5.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

401a666ba4488c71e500922a216881fbeaae5e3387d8b65f25224a9f4f5f42c5.exe

description	pid	process	target process
PID 1360 wrote to memory of 1216	1360	401a666ba4488c71e500922a216881fbeaae5e3387d8b65f25224a9f4f5f42c5.exe	WerFault.exe
PID 1360 wrote to memory of 1216	1360	401a666ba4488c71e500922a216881fbeaae5e3387d8b65f25224a9f4f5f42c5.exe	WerFault.exe
PID 1360 wrote to memory of 1216	1360	401a666ba4488c71e500922a216881fbeaae5e3387d8b65f25224a9f4f5f42c5.exe	WerFault.exe
PID 1360 wrote to memory of 1216	1360	401a666ba4488c71e500922a216881fbeaae5e3387d8b65f25224a9f4f5f42c5.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\401a666ba4488c71e500922a216881fbeaae5e3387d8b65f25224a9f4f5f42c5.exe
"C:\Users\Admin\AppData\Local\Temp\401a666ba4488c71e500922a216881fbeaae5e3387d8b65f25224a9f4f5f42c5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 148
2⤵
- Program crash
PID:1216

memory/1216-55-0x0000000000000000-mapping.dmp

Download
memory/1360-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1360-56-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download