86c533e201bb3436469c5a40546c8bba3fa13ea865def87c33f7e302db5f33a0

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-01-2023 08:24

Target

288-71-0x0000000000400000-0x0000000000421000-memory.exe
Size

132KB
MD5

f17f516ba4664092d5bb726099b48c9d
SHA1

f0aa961536a488f606ca02f0e063b45f7fe16ad4
SHA256

86c533e201bb3436469c5a40546c8bba3fa13ea865def87c33f7e302db5f33a0
SHA512

c9650ffa79df00b2a8778f760c8f916c497a3cbbac46b59d5737765871f951bd2ef2615816c7230e34dd8ce9692340787d3156d98c159e9257a9e447df5be25c
SSDEEP

3072:S4XgM0gTUJNFbnOabI/JZ7k0qvo7wvdbnrlSl26FabmrzqhE:NXgMtwNFbOabI/qxlSl26FaKrzqhE

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1056 112 WerFault.exe 288-71-0x0000000000400000-0x0000000000421000-memory.exe

pid	pid_target	process	target process
1056	112	WerFault.exe	288-71-0x0000000000400000-0x0000000000421000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

288-71-0x0000000000400000-0x0000000000421000-memory.exe

description	pid	process	target process
PID 112 wrote to memory of 1056	112	288-71-0x0000000000400000-0x0000000000421000-memory.exe	WerFault.exe
PID 112 wrote to memory of 1056	112	288-71-0x0000000000400000-0x0000000000421000-memory.exe	WerFault.exe
PID 112 wrote to memory of 1056	112	288-71-0x0000000000400000-0x0000000000421000-memory.exe	WerFault.exe
PID 112 wrote to memory of 1056	112	288-71-0x0000000000400000-0x0000000000421000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\288-71-0x0000000000400000-0x0000000000421000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\288-71-0x0000000000400000-0x0000000000421000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 172
2⤵
- Program crash
PID:1056

memory/112-54-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/1056-55-0x0000000000000000-mapping.dmp

Download