52cbe6f477cbd3724063b00ad2d8670a81b14b2f205ba54c9919e8ba859c47f7

Analysis

max time kernel
1s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 09:05

Target

3500-138-0x0000000010410000-0x000000001043F000-memory.exe
Size

188KB
MD5

a62e014d4032e0a1ab91d902446474c3
SHA1

f53f8f0bbb465235bec7254de72b1a3d6b6abd9b
SHA256

52cbe6f477cbd3724063b00ad2d8670a81b14b2f205ba54c9919e8ba859c47f7
SHA512

67f7c0b330876c796ee4ab2e13af6b86fb142dbe7f598c73f2b7d4093e6d0f95dae9ddce956ac08e5a5ef191dd63820f26a2ee0f11e75b1c11c3e53b299dbe52
SSDEEP

3072:TkT+VwL2ppo39HsM+/nW6fr5hQPtG5MLHSx8RT5+kJNEJ1YQ/os0DSMf:QTuvpopg/ts1G50y+RT5+jJp//0DSu

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1552 1796 WerFault.exe 3500-138-0x0000000010410000-0x000000001043F000-memory.exe

pid	pid_target	process	target process
1552	1796	WerFault.exe	3500-138-0x0000000010410000-0x000000001043F000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3500-138-0x0000000010410000-0x000000001043F000-memory.exe

description	pid	process	target process
PID 1796 wrote to memory of 1552	1796	3500-138-0x0000000010410000-0x000000001043F000-memory.exe	WerFault.exe
PID 1796 wrote to memory of 1552	1796	3500-138-0x0000000010410000-0x000000001043F000-memory.exe	WerFault.exe
PID 1796 wrote to memory of 1552	1796	3500-138-0x0000000010410000-0x000000001043F000-memory.exe	WerFault.exe
PID 1796 wrote to memory of 1552	1796	3500-138-0x0000000010410000-0x000000001043F000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3500-138-0x0000000010410000-0x000000001043F000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\3500-138-0x0000000010410000-0x000000001043F000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 36
2⤵
- Program crash
PID:1552