e5ccf468cfa1e385089706da558b54648959f396e7d657d7e578e14023a2603c

Analysis

max time kernel
6s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 15:07

Target

1608-66-0x0000000000400000-0x000000000042F000-memory.exe
Size

188KB
MD5

f7d8f20d9623d7ccf3f4bef4e8b8dff9
SHA1

6592ca08a6cce14947f5360f3a7a01497c9d442a
SHA256

e5ccf468cfa1e385089706da558b54648959f396e7d657d7e578e14023a2603c
SHA512

2158c5907bedc378c9cf6a6dfafc34bac6a4c1e2bc1d6e270ffd3ae33e36928ab966ffc592df5385dfa719fb33c118e8b401f2e686c6ddab034d5f1e3f314a9d
SSDEEP

3072:Zfxt8MPsI6OAc1fQhuHikQNgWIn7EWU/IsQcHOzULBfkqBP/jrvaDsJVwuz6:Zfr5UtcWbkQNeVmIPucyBfkgP/HSsJiu

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

940 1364 WerFault.exe 1608-66-0x0000000000400000-0x000000000042F000-memory.exe

pid	pid_target	process	target process
940	1364	WerFault.exe	1608-66-0x0000000000400000-0x000000000042F000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1608-66-0x0000000000400000-0x000000000042F000-memory.exe

description	pid	process	target process
PID 1364 wrote to memory of 940	1364	1608-66-0x0000000000400000-0x000000000042F000-memory.exe	WerFault.exe
PID 1364 wrote to memory of 940	1364	1608-66-0x0000000000400000-0x000000000042F000-memory.exe	WerFault.exe
PID 1364 wrote to memory of 940	1364	1608-66-0x0000000000400000-0x000000000042F000-memory.exe	WerFault.exe
PID 1364 wrote to memory of 940	1364	1608-66-0x0000000000400000-0x000000000042F000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1608-66-0x0000000000400000-0x000000000042F000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1608-66-0x0000000000400000-0x000000000042F000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 36
  2⤵
  - Program crash
  PID:940