a1a7c2ff9794bca1de6367d24f1322a75e9670d74afb8f0c7503f155fdfa5fc9

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
08-12-2022 16:21

Target

1476-66-0x0000000000400000-0x000000000042F000-memory.exe
Size

188KB
MD5

ab736b55d40e21e78896fff47f6f6486
SHA1

916fcea6480898cb74f48663f0c61deb0200b7af
SHA256

a1a7c2ff9794bca1de6367d24f1322a75e9670d74afb8f0c7503f155fdfa5fc9
SHA512

40d51b743ea1f032be6cdb7d58d005f01ee5eea7edae359933ddd02813980c85d47aec72f2a17007e9be04ee2bf960028513717eda537ce400b0a4b5315f46f4
SSDEEP

3072:G9ypGcz0VpkobZ4hTJWJW4XAlrLCQqIAW2q9tpGExZ1tGaXcGN8nM4g:G9wAbpahTAEpCdq2MpGExZua18nM4

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

928 992 WerFault.exe 1476-66-0x0000000000400000-0x000000000042F000-memory.exe

pid	pid_target	process	target process
928	992	WerFault.exe	1476-66-0x0000000000400000-0x000000000042F000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1476-66-0x0000000000400000-0x000000000042F000-memory.exe

description	pid	process	target process
PID 992 wrote to memory of 928	992	1476-66-0x0000000000400000-0x000000000042F000-memory.exe	WerFault.exe
PID 992 wrote to memory of 928	992	1476-66-0x0000000000400000-0x000000000042F000-memory.exe	WerFault.exe
PID 992 wrote to memory of 928	992	1476-66-0x0000000000400000-0x000000000042F000-memory.exe	WerFault.exe
PID 992 wrote to memory of 928	992	1476-66-0x0000000000400000-0x000000000042F000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1476-66-0x0000000000400000-0x000000000042F000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1476-66-0x0000000000400000-0x000000000042F000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 36
2⤵
- Program crash
PID:928