476ae9f56ae458a9feec9a5f59133aee194a5855e4e71b2617355aec225d20cc

Analysis

max time kernel
38s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 00:18

Target

476ae9f56ae458a9feec9a5f59133aee194a5855e4e71b2617355aec225d20cc.exe
Size

356KB
MD5

168048d4468475733d83da3ebd2de086
SHA1

1a6b91f3eaf8a81a5a4a97a45110c77f1d90cadf
SHA256

476ae9f56ae458a9feec9a5f59133aee194a5855e4e71b2617355aec225d20cc
SHA512

44113b8518ef4c59acc1f690a6dcd5ae8dad4e9878f1f3d7cbaea5952a0bba9b1acc703d9a3f3fa111594fe9aec6054e136efd4e224aba006a6ec3ff278104b5
SSDEEP

6144:5Ec0f7XP+g3AGJpWVzunhYrgns+XuCKnvmb7/D263VAPL8R8FUjcWMHu9tmuE79m:R27/XvLWpuhogns+XuCKnvmb7/D263Qq

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2024 1704 WerFault.exe 476ae9f56ae458a9feec9a5f59133aee194a5855e4e71b2617355aec225d20cc.exe

pid	pid_target	process	target process
2024	1704	WerFault.exe	476ae9f56ae458a9feec9a5f59133aee194a5855e4e71b2617355aec225d20cc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

476ae9f56ae458a9feec9a5f59133aee194a5855e4e71b2617355aec225d20cc.exe

description	pid	process	target process
PID 1704 wrote to memory of 2024	1704	476ae9f56ae458a9feec9a5f59133aee194a5855e4e71b2617355aec225d20cc.exe	WerFault.exe
PID 1704 wrote to memory of 2024	1704	476ae9f56ae458a9feec9a5f59133aee194a5855e4e71b2617355aec225d20cc.exe	WerFault.exe
PID 1704 wrote to memory of 2024	1704	476ae9f56ae458a9feec9a5f59133aee194a5855e4e71b2617355aec225d20cc.exe	WerFault.exe
PID 1704 wrote to memory of 2024	1704	476ae9f56ae458a9feec9a5f59133aee194a5855e4e71b2617355aec225d20cc.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\476ae9f56ae458a9feec9a5f59133aee194a5855e4e71b2617355aec225d20cc.exe
"C:\Users\Admin\AppData\Local\Temp\476ae9f56ae458a9feec9a5f59133aee194a5855e4e71b2617355aec225d20cc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 148
2⤵
- Program crash
PID:2024

memory/1704-55-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2024-54-0x0000000000000000-mapping.dmp

Download