62f06eb65045d58307b956a36165debb1d4a756bda34b132a67f09129fbc98f5

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
20-12-2022 18:22

Target

62f06eb65045d58307b956a36165debb1d4a756bda34b132a67f09129fbc98f5.exe
Size

186KB
MD5

140aac1d1ae0448bfb549b3912a3dd2f
SHA1

a8cdda51793b197a6ce122b99078e32f9f190e65
SHA256

62f06eb65045d58307b956a36165debb1d4a756bda34b132a67f09129fbc98f5
SHA512

fa741efc2ad6f4ed55e031006e0253b047022f0e3f6288b9519cddf420215184d8d64a9a20ed365caef98556565b3db9af5ab90739b0abb48d9c5496355722c6
SSDEEP

3072:8LHM+RC9EAmP6/mmPvyRtH4fNu/3mA/SDdtKfD8Q/mnyZ4A3ZNxVpPgGfqBdY:GHM+kmP0mmy3kcVSDGIQOnyyGiE

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2028 1308 WerFault.exe 62f06eb65045d58307b956a36165debb1d4a756bda34b132a67f09129fbc98f5.exe

pid	pid_target	process	target process
2028	1308	WerFault.exe	62f06eb65045d58307b956a36165debb1d4a756bda34b132a67f09129fbc98f5.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

62f06eb65045d58307b956a36165debb1d4a756bda34b132a67f09129fbc98f5.exe

description	pid	process	target process
PID 1308 wrote to memory of 2028	1308	62f06eb65045d58307b956a36165debb1d4a756bda34b132a67f09129fbc98f5.exe	WerFault.exe
PID 1308 wrote to memory of 2028	1308	62f06eb65045d58307b956a36165debb1d4a756bda34b132a67f09129fbc98f5.exe	WerFault.exe
PID 1308 wrote to memory of 2028	1308	62f06eb65045d58307b956a36165debb1d4a756bda34b132a67f09129fbc98f5.exe	WerFault.exe
PID 1308 wrote to memory of 2028	1308	62f06eb65045d58307b956a36165debb1d4a756bda34b132a67f09129fbc98f5.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\62f06eb65045d58307b956a36165debb1d4a756bda34b132a67f09129fbc98f5.exe
"C:\Users\Admin\AppData\Local\Temp\62f06eb65045d58307b956a36165debb1d4a756bda34b132a67f09129fbc98f5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 152
2⤵
- Program crash
PID:2028

memory/1308-54-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/2028-55-0x0000000000000000-mapping.dmp

Download