6e3781ffdfc9304c865380884795e5ad79ed1f8fa0c981282d602143053c1f2f

Analysis

max time kernel
3s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 00:21

Target

6e3781ffdfc9304c865380884795e5ad79ed1f8fa0c981282d602143053c1f2f.exe
Size

384KB
MD5

17231140127897d0c94929fe1e8c60c6
SHA1

de4f020d294c45aba64410a42984faf4ac52b2af
SHA256

6e3781ffdfc9304c865380884795e5ad79ed1f8fa0c981282d602143053c1f2f
SHA512

7af6e9e3b1e9049cae49eb79929ceb2ba8c0c561d4f3c7af856e67a08b2a28c904951bf98d8a42307bb15ba532c498e832742402d1f8953eaaba6a9cd328cbae
SSDEEP

6144:l0JVjEXpSuhRjAfpVzs+txf3myzc9f35Q67l1tR0CugEv5CAF:mJVYXpSuhR0fDs+tUsc9f3b3BrEB9

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1968 1300 WerFault.exe 6e3781ffdfc9304c865380884795e5ad79ed1f8fa0c981282d602143053c1f2f.exe

pid	pid_target	process	target process
1968	1300	WerFault.exe	6e3781ffdfc9304c865380884795e5ad79ed1f8fa0c981282d602143053c1f2f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6e3781ffdfc9304c865380884795e5ad79ed1f8fa0c981282d602143053c1f2f.exe

description	pid	process	target process
PID 1300 wrote to memory of 1968	1300	6e3781ffdfc9304c865380884795e5ad79ed1f8fa0c981282d602143053c1f2f.exe	WerFault.exe
PID 1300 wrote to memory of 1968	1300	6e3781ffdfc9304c865380884795e5ad79ed1f8fa0c981282d602143053c1f2f.exe	WerFault.exe
PID 1300 wrote to memory of 1968	1300	6e3781ffdfc9304c865380884795e5ad79ed1f8fa0c981282d602143053c1f2f.exe	WerFault.exe
PID 1300 wrote to memory of 1968	1300	6e3781ffdfc9304c865380884795e5ad79ed1f8fa0c981282d602143053c1f2f.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6e3781ffdfc9304c865380884795e5ad79ed1f8fa0c981282d602143053c1f2f.exe
"C:\Users\Admin\AppData\Local\Temp\6e3781ffdfc9304c865380884795e5ad79ed1f8fa0c981282d602143053c1f2f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 148
2⤵
- Program crash
PID:1968

memory/1300-54-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1968-55-0x0000000000000000-mapping.dmp

Download