1c4fec807cd6aed111e2a703314b2887c348276e9c5994467011db8de2e082b2

Analysis

max time kernel
4s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 16:38

Target

1c4fec807cd6aed111e2a703314b2887c348276e9c5994467011db8de2e082b2.exe
Size

66KB
MD5

598a01945b4758aafc2ff23a2257c96d
SHA1

0f015792e16a9853a521ef21eb28185c740fe9d8
SHA256

1c4fec807cd6aed111e2a703314b2887c348276e9c5994467011db8de2e082b2
SHA512

9b41d619f431466cfc3b0095bcec131075fc3d39c79f2b5db19ccf3dc467c64736201fa8f5b609698730c09078ee79bcbe359e1b8b45d8ba41167ee4486c4d30
SSDEEP

1536:KVLnRsRQ0S6MD9MoBoRv9i6uMeDHe2ow/aUDG9qJxxVfBd:IrSO0S6M5r5S2R/i9G1fL

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1612 2032 WerFault.exe 1c4fec807cd6aed111e2a703314b2887c348276e9c5994467011db8de2e082b2.exe

pid	pid_target	process	target process
1612	2032	WerFault.exe	1c4fec807cd6aed111e2a703314b2887c348276e9c5994467011db8de2e082b2.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1c4fec807cd6aed111e2a703314b2887c348276e9c5994467011db8de2e082b2.exe

description	pid	process	target process
PID 2032 wrote to memory of 1612	2032	1c4fec807cd6aed111e2a703314b2887c348276e9c5994467011db8de2e082b2.exe	WerFault.exe
PID 2032 wrote to memory of 1612	2032	1c4fec807cd6aed111e2a703314b2887c348276e9c5994467011db8de2e082b2.exe	WerFault.exe
PID 2032 wrote to memory of 1612	2032	1c4fec807cd6aed111e2a703314b2887c348276e9c5994467011db8de2e082b2.exe	WerFault.exe
PID 2032 wrote to memory of 1612	2032	1c4fec807cd6aed111e2a703314b2887c348276e9c5994467011db8de2e082b2.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1c4fec807cd6aed111e2a703314b2887c348276e9c5994467011db8de2e082b2.exe
"C:\Users\Admin\AppData\Local\Temp\1c4fec807cd6aed111e2a703314b2887c348276e9c5994467011db8de2e082b2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 36
  2⤵
  - Program crash
  PID:1612

memory/1612-55-0x0000000000000000-mapping.dmp

Download
memory/2032-54-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download