eae881de2657ebaecba327527d8f21d359893504d15575a37eb9a9de82789e40

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-12-2022 23:41

Target

1760-65-0x0000000000400000-0x000000000042E000-memory.exe
Size

184KB
MD5

c7f0efbe3914d5d01c4d742a25014967
SHA1

e99803e2f8c6e05152cdb8394abd2ca2216abec9
SHA256

eae881de2657ebaecba327527d8f21d359893504d15575a37eb9a9de82789e40
SHA512

f02052d129dac8e756c14c22f4471a13d436cc2764d589827037d8cb6d7f0bcd443a201d152ea5b875609823ab6acf5c8f46e253dcb02ab781736f6b46b3b43e
SSDEEP

3072:cNYM6B+svOQbvFhTJWMS4KNsbJlC5a2La//wsoH7RzeS4wSBgO:ccEsGghTVgSJMo2i4s4peH

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1236 1348 WerFault.exe 1760-65-0x0000000000400000-0x000000000042E000-memory.exe

pid	pid_target	process	target process
1236	1348	WerFault.exe	1760-65-0x0000000000400000-0x000000000042E000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1760-65-0x0000000000400000-0x000000000042E000-memory.exe

description	pid	process	target process
PID 1348 wrote to memory of 1236	1348	1760-65-0x0000000000400000-0x000000000042E000-memory.exe	WerFault.exe
PID 1348 wrote to memory of 1236	1348	1760-65-0x0000000000400000-0x000000000042E000-memory.exe	WerFault.exe
PID 1348 wrote to memory of 1236	1348	1760-65-0x0000000000400000-0x000000000042E000-memory.exe	WerFault.exe
PID 1348 wrote to memory of 1236	1348	1760-65-0x0000000000400000-0x000000000042E000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1760-65-0x0000000000400000-0x000000000042E000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1760-65-0x0000000000400000-0x000000000042E000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 36
2⤵
- Program crash
PID:1236