0a6b024411bfb27075b4e3e4378db98fa004c6920003c376018eace74dcf282d

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:14

Target

0a6b024411bfb27075b4e3e4378db98fa004c6920003c376018eace74dcf282d.exe
Size

172KB
MD5

1f4e7c20dadac75a754a845fd13b8355
SHA1

fe2c86047f92645b90ef85a244d61b504ce7f78f
SHA256

0a6b024411bfb27075b4e3e4378db98fa004c6920003c376018eace74dcf282d
SHA512

0148dfa3551d2d0d50b8faa6d7ab5aacbc4222b6572cc9ecca1b4346759ffe818282a30d942579378d18a2b4ebc6d347c01ee9f2005c96e5934562e79e3431dd
SSDEEP

3072:RQIyRTXJFnw+Iis1W6NsN7GsHa1Tlg06R3SGQf5Lf56fl/g+j58C:RqrM1Y3Ha9KxoNfTUaC

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1956 112 WerFault.exe 0a6b024411bfb27075b4e3e4378db98fa004c6920003c376018eace74dcf282d.exe

pid	pid_target	process	target process
1956	112	WerFault.exe	0a6b024411bfb27075b4e3e4378db98fa004c6920003c376018eace74dcf282d.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

0a6b024411bfb27075b4e3e4378db98fa004c6920003c376018eace74dcf282d.exe

description	pid	process	target process
PID 112 wrote to memory of 1956	112	0a6b024411bfb27075b4e3e4378db98fa004c6920003c376018eace74dcf282d.exe	WerFault.exe
PID 112 wrote to memory of 1956	112	0a6b024411bfb27075b4e3e4378db98fa004c6920003c376018eace74dcf282d.exe	WerFault.exe
PID 112 wrote to memory of 1956	112	0a6b024411bfb27075b4e3e4378db98fa004c6920003c376018eace74dcf282d.exe	WerFault.exe
PID 112 wrote to memory of 1956	112	0a6b024411bfb27075b4e3e4378db98fa004c6920003c376018eace74dcf282d.exe	WerFault.exe
PID 112 wrote to memory of 1956	112	0a6b024411bfb27075b4e3e4378db98fa004c6920003c376018eace74dcf282d.exe	WerFault.exe
PID 112 wrote to memory of 1956	112	0a6b024411bfb27075b4e3e4378db98fa004c6920003c376018eace74dcf282d.exe	WerFault.exe
PID 112 wrote to memory of 1956	112	0a6b024411bfb27075b4e3e4378db98fa004c6920003c376018eace74dcf282d.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0a6b024411bfb27075b4e3e4378db98fa004c6920003c376018eace74dcf282d.exe
"C:\Users\Admin\AppData\Local\Temp\0a6b024411bfb27075b4e3e4378db98fa004c6920003c376018eace74dcf282d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 268
2⤵
- Program crash
PID:1956

memory/112-54-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/112-56-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/112-57-0x0000000000240000-0x000000000028A000-memory.dmp

Filesize
296KB

Download
memory/1956-55-0x0000000000000000-mapping.dmp

Download