c681960f2f9a71f104c4594a6dbdea3a60a6646907fd66cc7c10d0fff3500382

Analysis

max time kernel
247s
max time network
333s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 09:45

Target

4920-139-0x0000000000400000-0x000000000042F000-memory.exe
Size

188KB
MD5

03896d4402c7f4534d9fe3362306d30e
SHA1

16a16465e7133cb8408b11707f8b1ef45ad16bb7
SHA256

c681960f2f9a71f104c4594a6dbdea3a60a6646907fd66cc7c10d0fff3500382
SHA512

64fa2ec871b9f35ad6038bcaa260ff2a8fba2d10f8d75fa0bbf8b17dc7f8cff6eb014feebdd011437c46f0687cd2d4d1f75f5913ff5ac064c10f94ded5ae2fa2
SSDEEP

3072:rMCnnLW6ohjWXF+GcphTJWlBIei7b/XBpkkh1O4NWN7zhQ9jXlTXA9t6:rBKjF4IhT0MP/x2khAyWNe9Zx

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1520 288 WerFault.exe 4920-139-0x0000000000400000-0x000000000042F000-memory.exe

pid	pid_target	process	target process
1520	288	WerFault.exe	4920-139-0x0000000000400000-0x000000000042F000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4920-139-0x0000000000400000-0x000000000042F000-memory.exe

description	pid	process	target process
PID 288 wrote to memory of 1520	288	4920-139-0x0000000000400000-0x000000000042F000-memory.exe	WerFault.exe
PID 288 wrote to memory of 1520	288	4920-139-0x0000000000400000-0x000000000042F000-memory.exe	WerFault.exe
PID 288 wrote to memory of 1520	288	4920-139-0x0000000000400000-0x000000000042F000-memory.exe	WerFault.exe
PID 288 wrote to memory of 1520	288	4920-139-0x0000000000400000-0x000000000042F000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4920-139-0x0000000000400000-0x000000000042F000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\4920-139-0x0000000000400000-0x000000000042F000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 288 -s 36
2⤵
- Program crash
PID:1520