721bdb744338d2e4525c9bbeecbf2129a71c67a2795c083306438997515b366c

Analysis

max time kernel
22s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:09

Target

721bdb744338d2e4525c9bbeecbf2129a71c67a2795c083306438997515b366c.exe
Size

203KB
MD5

2c8b9214aa095084ae92973f7905abe4
SHA1

93075b164b3edc8b52aa5ae0a768c20592800409
SHA256

721bdb744338d2e4525c9bbeecbf2129a71c67a2795c083306438997515b366c
SHA512

3b250e5537e7fa9efa528413495b057494a26807d48b30c6cec87240c25071fd3dfbe100fce23d6281d0ac6261ceaffa87cc0b16cab4964bac953f4cabb279db
SSDEEP

3072:Ymilo6QztL+qvFumrpGbpV4kHs2vhtRaATcKmFJYIL9HK/Jlst:HFsR5mj3L9qrst

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1904 916 WerFault.exe 721bdb744338d2e4525c9bbeecbf2129a71c67a2795c083306438997515b366c.exe

pid	pid_target	process	target process
1904	916	WerFault.exe	721bdb744338d2e4525c9bbeecbf2129a71c67a2795c083306438997515b366c.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

721bdb744338d2e4525c9bbeecbf2129a71c67a2795c083306438997515b366c.exe

description	pid	process	target process
PID 916 wrote to memory of 1904	916	721bdb744338d2e4525c9bbeecbf2129a71c67a2795c083306438997515b366c.exe	WerFault.exe
PID 916 wrote to memory of 1904	916	721bdb744338d2e4525c9bbeecbf2129a71c67a2795c083306438997515b366c.exe	WerFault.exe
PID 916 wrote to memory of 1904	916	721bdb744338d2e4525c9bbeecbf2129a71c67a2795c083306438997515b366c.exe	WerFault.exe
PID 916 wrote to memory of 1904	916	721bdb744338d2e4525c9bbeecbf2129a71c67a2795c083306438997515b366c.exe	WerFault.exe
PID 916 wrote to memory of 1904	916	721bdb744338d2e4525c9bbeecbf2129a71c67a2795c083306438997515b366c.exe	WerFault.exe
PID 916 wrote to memory of 1904	916	721bdb744338d2e4525c9bbeecbf2129a71c67a2795c083306438997515b366c.exe	WerFault.exe
PID 916 wrote to memory of 1904	916	721bdb744338d2e4525c9bbeecbf2129a71c67a2795c083306438997515b366c.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\721bdb744338d2e4525c9bbeecbf2129a71c67a2795c083306438997515b366c.exe
"C:\Users\Admin\AppData\Local\Temp\721bdb744338d2e4525c9bbeecbf2129a71c67a2795c083306438997515b366c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 324
2⤵
- Program crash
PID:1904

memory/916-54-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download
memory/916-56-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/916-57-0x0000000000230000-0x000000000026B000-memory.dmp

Filesize
236KB

Download
memory/916-58-0x0000000000230000-0x000000000026B000-memory.dmp

Filesize
236KB

Download
memory/1904-55-0x0000000000000000-mapping.dmp

Download