e63747632ca869948433b4dea0d84d844d171d3bf42440eb651238dd697ad1d7

Analysis

max time kernel
4s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 16:03

Target

1760-66-0x0000000000400000-0x000000000042E000-memory.exe
Size

184KB
MD5

3ab6762aed6d9f7a533e99667a7a39ec
SHA1

dab1cec106283d76ade6df998ed786b53aa6e843
SHA256

e63747632ca869948433b4dea0d84d844d171d3bf42440eb651238dd697ad1d7
SHA512

9d909ade23a73401231866022824ebe2f90c4ec431c2f630c6d66d83539ea3ded696cff99fbf17ce3358c7842cbe497c73a9387c2cf334fa4277447dfe57c87e
SSDEEP

3072:UOCtubqZxfEKoBqJWTXf4V2Sr3XFDSPwCzFPiA5vhYlHXl:AFPc5qKXQjXVSP7zFPiABh

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1792 1820 WerFault.exe 1760-66-0x0000000000400000-0x000000000042E000-memory.exe

pid	pid_target	process	target process
1792	1820	WerFault.exe	1760-66-0x0000000000400000-0x000000000042E000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1760-66-0x0000000000400000-0x000000000042E000-memory.exe

description	pid	process	target process
PID 1820 wrote to memory of 1792	1820	1760-66-0x0000000000400000-0x000000000042E000-memory.exe	WerFault.exe
PID 1820 wrote to memory of 1792	1820	1760-66-0x0000000000400000-0x000000000042E000-memory.exe	WerFault.exe
PID 1820 wrote to memory of 1792	1820	1760-66-0x0000000000400000-0x000000000042E000-memory.exe	WerFault.exe
PID 1820 wrote to memory of 1792	1820	1760-66-0x0000000000400000-0x000000000042E000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1760-66-0x0000000000400000-0x000000000042E000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1760-66-0x0000000000400000-0x000000000042E000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 36
2⤵
- Program crash
PID:1792