c313db7d3ae70272b72eebcec00c990a89c9a554e67e5bf6b50e638232fc919e

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 19:40

Target

c313db7d3ae70272b72eebcec00c990a89c9a554e67e5bf6b50e638232fc919e.exe
Size

244KB
MD5

5feef2236736c87bdd4e22dae28baf20
SHA1

5a2e2bcfb448fdf2dc9151e6b8792773e5cbe55f
SHA256

c313db7d3ae70272b72eebcec00c990a89c9a554e67e5bf6b50e638232fc919e
SHA512

05485c3244c6ef31e44ef64aec2328409be60e89ccf9158ea8cfc68e45759458d15627ae67bad226c03fd5e0af360765bf9449d3afcb8af8cf2875f78dd80bd7
SSDEEP

3072:PYujGyjmrXFF8bIFebOyjmrlyjmrOWMsKkjdJo4QCjyjmrZS+:PYujEb8mew1oCrE+

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1420 1600 WerFault.exe c313db7d3ae70272b72eebcec00c990a89c9a554e67e5bf6b50e638232fc919e.exe

pid	pid_target	process	target process
1420	1600	WerFault.exe	c313db7d3ae70272b72eebcec00c990a89c9a554e67e5bf6b50e638232fc919e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c313db7d3ae70272b72eebcec00c990a89c9a554e67e5bf6b50e638232fc919e.exe

description	pid	process	target process
PID 1600 wrote to memory of 1420	1600	c313db7d3ae70272b72eebcec00c990a89c9a554e67e5bf6b50e638232fc919e.exe	WerFault.exe
PID 1600 wrote to memory of 1420	1600	c313db7d3ae70272b72eebcec00c990a89c9a554e67e5bf6b50e638232fc919e.exe	WerFault.exe
PID 1600 wrote to memory of 1420	1600	c313db7d3ae70272b72eebcec00c990a89c9a554e67e5bf6b50e638232fc919e.exe	WerFault.exe
PID 1600 wrote to memory of 1420	1600	c313db7d3ae70272b72eebcec00c990a89c9a554e67e5bf6b50e638232fc919e.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c313db7d3ae70272b72eebcec00c990a89c9a554e67e5bf6b50e638232fc919e.exe
"C:\Users\Admin\AppData\Local\Temp\c313db7d3ae70272b72eebcec00c990a89c9a554e67e5bf6b50e638232fc919e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 552
2⤵
- Program crash
PID:1420

memory/1420-55-0x0000000000000000-mapping.dmp

Download
memory/1600-54-0x0000000000F90000-0x0000000000FD4000-memory.dmp

Filesize
272KB

Download