7d31dc47d06cbc2fe3fc4c11ed7f261da278cb68b66c84d865955e00158d0144

Analysis

max time kernel
48s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 22:16

Target

7d31dc47d06cbc2fe3fc4c11ed7f261da278cb68b66c84d865955e00158d0144.exe
Size

293KB
MD5

422b988dc7143a8b718772d00bae82c0
SHA1

608d1b79c396a153b8404152fdea77671cf8010f
SHA256

7d31dc47d06cbc2fe3fc4c11ed7f261da278cb68b66c84d865955e00158d0144
SHA512

a94360e6eaa7c9c317e167ed704b01ab9ff0dd2a4e724dda52b0be0acfa62e1abfbd001ce4a50f65fdce2dc078e545b4713dd7182365a1c7478531b7be10c1b0
SSDEEP

6144:RG377xS2Vl2CeiorXdwTBgWx4ETJC531CpcCJJvHB:Er7xS2Vl6RwTyCHbJJvHB

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1356 1376 WerFault.exe 7d31dc47d06cbc2fe3fc4c11ed7f261da278cb68b66c84d865955e00158d0144.exe

pid	pid_target	process	target process
1356	1376	WerFault.exe	7d31dc47d06cbc2fe3fc4c11ed7f261da278cb68b66c84d865955e00158d0144.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7d31dc47d06cbc2fe3fc4c11ed7f261da278cb68b66c84d865955e00158d0144.exe

description	pid	process	target process
PID 1376 wrote to memory of 1356	1376	7d31dc47d06cbc2fe3fc4c11ed7f261da278cb68b66c84d865955e00158d0144.exe	WerFault.exe
PID 1376 wrote to memory of 1356	1376	7d31dc47d06cbc2fe3fc4c11ed7f261da278cb68b66c84d865955e00158d0144.exe	WerFault.exe
PID 1376 wrote to memory of 1356	1376	7d31dc47d06cbc2fe3fc4c11ed7f261da278cb68b66c84d865955e00158d0144.exe	WerFault.exe
PID 1376 wrote to memory of 1356	1376	7d31dc47d06cbc2fe3fc4c11ed7f261da278cb68b66c84d865955e00158d0144.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7d31dc47d06cbc2fe3fc4c11ed7f261da278cb68b66c84d865955e00158d0144.exe
"C:\Users\Admin\AppData\Local\Temp\7d31dc47d06cbc2fe3fc4c11ed7f261da278cb68b66c84d865955e00158d0144.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 204
2⤵
- Program crash
PID:1356

memory/1356-55-0x0000000000000000-mapping.dmp

Download
memory/1376-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download