9a6d7af4c50b50020b04457feefd6fc613d85a3b191aa74e42907dc8003cb708

Analysis

max time kernel
29s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 03:45

Target

9a6d7af4c50b50020b04457feefd6fc613d85a3b191aa74e42907dc8003cb708.exe
Size

97KB
MD5

044d6a633335277fae0d33851f91e21f
SHA1

60592ba8eb36448b867749a22f96a9d13259f6ae
SHA256

9a6d7af4c50b50020b04457feefd6fc613d85a3b191aa74e42907dc8003cb708
SHA512

97a5b12f8dd5f1353ada7ee0babf4d0471907284a788560cea1b33eb8af74a2f215990d30605af56fa92477fa29c1bcb9c917ee042fc563136279f7ff7f618cc
SSDEEP

1536:RzZZpp48Zt0lo+4EMMyO3OexOSEowTwBjzvcmJoxDWqfqNII2Ca2E9:pZilI/HUOjSiToj7CEqfqg2E9

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

952 1812 WerFault.exe 9a6d7af4c50b50020b04457feefd6fc613d85a3b191aa74e42907dc8003cb708.exe

pid	pid_target	process	target process
952	1812	WerFault.exe	9a6d7af4c50b50020b04457feefd6fc613d85a3b191aa74e42907dc8003cb708.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9a6d7af4c50b50020b04457feefd6fc613d85a3b191aa74e42907dc8003cb708.exe

description	pid	process	target process
PID 1812 wrote to memory of 952	1812	9a6d7af4c50b50020b04457feefd6fc613d85a3b191aa74e42907dc8003cb708.exe	WerFault.exe
PID 1812 wrote to memory of 952	1812	9a6d7af4c50b50020b04457feefd6fc613d85a3b191aa74e42907dc8003cb708.exe	WerFault.exe
PID 1812 wrote to memory of 952	1812	9a6d7af4c50b50020b04457feefd6fc613d85a3b191aa74e42907dc8003cb708.exe	WerFault.exe
PID 1812 wrote to memory of 952	1812	9a6d7af4c50b50020b04457feefd6fc613d85a3b191aa74e42907dc8003cb708.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9a6d7af4c50b50020b04457feefd6fc613d85a3b191aa74e42907dc8003cb708.exe
"C:\Users\Admin\AppData\Local\Temp\9a6d7af4c50b50020b04457feefd6fc613d85a3b191aa74e42907dc8003cb708.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 168
2⤵
- Program crash
PID:952

memory/952-55-0x0000000000000000-mapping.dmp

Download
memory/1812-54-0x00000000753F1000-0x00000000753F3000-memory.dmp

Filesize
8KB

Download
memory/1812-56-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download