53f34301a4d129a29297ec6e0f0a3a3c55133e52eab81f607ba8a515103dcd6f

Analysis

max time kernel
24s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 01:57

Target

53f34301a4d129a29297ec6e0f0a3a3c55133e52eab81f607ba8a515103dcd6f.exe
Size

66KB
MD5

45ac8fb6f0cf57f4c7535e7382a5540e
SHA1

ebfc03a56d80eb9b306db3cda0529064b10222a8
SHA256

53f34301a4d129a29297ec6e0f0a3a3c55133e52eab81f607ba8a515103dcd6f
SHA512

7feaf98fc04323d69a0a62255796cc56644379c1921451536426a0ba7f9243581a04ca621ae7ac1f197f061d542b270e0d1f234634322a8e770c4b850cbdb32e
SSDEEP

1536:t4WFlsrCnE03afjhpQoHRqZR8vUsoWb2:tfqjfHQoxqLsfoK

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

916 1632 WerFault.exe 53f34301a4d129a29297ec6e0f0a3a3c55133e52eab81f607ba8a515103dcd6f.exe

pid	pid_target	process	target process
916	1632	WerFault.exe	53f34301a4d129a29297ec6e0f0a3a3c55133e52eab81f607ba8a515103dcd6f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

53f34301a4d129a29297ec6e0f0a3a3c55133e52eab81f607ba8a515103dcd6f.exe

description	pid	process	target process
PID 1632 wrote to memory of 916	1632	53f34301a4d129a29297ec6e0f0a3a3c55133e52eab81f607ba8a515103dcd6f.exe	WerFault.exe
PID 1632 wrote to memory of 916	1632	53f34301a4d129a29297ec6e0f0a3a3c55133e52eab81f607ba8a515103dcd6f.exe	WerFault.exe
PID 1632 wrote to memory of 916	1632	53f34301a4d129a29297ec6e0f0a3a3c55133e52eab81f607ba8a515103dcd6f.exe	WerFault.exe
PID 1632 wrote to memory of 916	1632	53f34301a4d129a29297ec6e0f0a3a3c55133e52eab81f607ba8a515103dcd6f.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\53f34301a4d129a29297ec6e0f0a3a3c55133e52eab81f607ba8a515103dcd6f.exe
"C:\Users\Admin\AppData\Local\Temp\53f34301a4d129a29297ec6e0f0a3a3c55133e52eab81f607ba8a515103dcd6f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 148
  2⤵
  - Program crash
  PID:916

memory/916-55-0x0000000000000000-mapping.dmp

Download
memory/1632-54-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download