567dc367934c0def3d09f8e6d2f27d1bc8240de9b673420693ba3ea788195bf1

Analysis

max time kernel
34s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09-12-2022 00:38

Target

1324-143-0x0000000000400000-0x000000000042F000-memory.exe
Size

188KB
MD5

a95c62679253c711f1d80d7883000fd6
SHA1

af31c86f1476d5f39c089c94ada403e2eb64b296
SHA256

567dc367934c0def3d09f8e6d2f27d1bc8240de9b673420693ba3ea788195bf1
SHA512

0625b89e2edfbbe0772c90d49a4d1fddc0119567d67cdc0444943c0e99efed7bef83bbf23369bf2e3dabc1fada83a690f176c1c3babf1ef752f49a151517dbfe
SSDEEP

3072:C3Y2i757hNP34Js1pWtavo0Ax9pn6LSDsuQPar+FA9WDStlEtSDT2doah+g7TT:C3Y2i7hJ3t1IacHnKYhF6A9W8E8DTFc5

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2004 1608 WerFault.exe 1324-143-0x0000000000400000-0x000000000042F000-memory.exe

pid	pid_target	process	target process
2004	1608	WerFault.exe	1324-143-0x0000000000400000-0x000000000042F000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1324-143-0x0000000000400000-0x000000000042F000-memory.exe

description	pid	process	target process
PID 1608 wrote to memory of 2004	1608	1324-143-0x0000000000400000-0x000000000042F000-memory.exe	WerFault.exe
PID 1608 wrote to memory of 2004	1608	1324-143-0x0000000000400000-0x000000000042F000-memory.exe	WerFault.exe
PID 1608 wrote to memory of 2004	1608	1324-143-0x0000000000400000-0x000000000042F000-memory.exe	WerFault.exe
PID 1608 wrote to memory of 2004	1608	1324-143-0x0000000000400000-0x000000000042F000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1324-143-0x0000000000400000-0x000000000042F000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1324-143-0x0000000000400000-0x000000000042F000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 36
2⤵
- Program crash
PID:2004