942d08625abb07ad3007839d737192a9180468f1475d89888874f55f1300946d

Analysis

max time kernel
3s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 05:55

Target

942d08625abb07ad3007839d737192a9180468f1475d89888874f55f1300946d.exe
Size

28KB
MD5

0fb7c8f601dfbefcd3ba68aad2916f23
SHA1

585ac765b1e32029760ce12c8dbc610a155d6f0d
SHA256

942d08625abb07ad3007839d737192a9180468f1475d89888874f55f1300946d
SHA512

1f2c9631a03a51f733f6563e4afc6e20eec6a69a3630f002e075384b9e304a145963f0cc0078974be56cd1738930b61ddc1b718c56ae8402372f0ef0758a3c6b
SSDEEP

384:7VxT5T8TckZUSPxuEUi0ZbQzZrf6+MLv5lY644ozgz65qk3Vq/EUkx87t2Qj:XFLkBxuEp0WzZrfZNdpO6lVqMrxUgQj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1076 1764 WerFault.exe 942d08625abb07ad3007839d737192a9180468f1475d89888874f55f1300946d.exe

pid	pid_target	process	target process
1076	1764	WerFault.exe	942d08625abb07ad3007839d737192a9180468f1475d89888874f55f1300946d.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

942d08625abb07ad3007839d737192a9180468f1475d89888874f55f1300946d.exe

description	pid	process	target process
PID 1764 wrote to memory of 1076	1764	942d08625abb07ad3007839d737192a9180468f1475d89888874f55f1300946d.exe	WerFault.exe
PID 1764 wrote to memory of 1076	1764	942d08625abb07ad3007839d737192a9180468f1475d89888874f55f1300946d.exe	WerFault.exe
PID 1764 wrote to memory of 1076	1764	942d08625abb07ad3007839d737192a9180468f1475d89888874f55f1300946d.exe	WerFault.exe
PID 1764 wrote to memory of 1076	1764	942d08625abb07ad3007839d737192a9180468f1475d89888874f55f1300946d.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\942d08625abb07ad3007839d737192a9180468f1475d89888874f55f1300946d.exe
"C:\Users\Admin\AppData\Local\Temp\942d08625abb07ad3007839d737192a9180468f1475d89888874f55f1300946d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 100
2⤵
- Program crash
PID:1076

memory/1076-55-0x0000000000000000-mapping.dmp

Download
memory/1764-54-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download