101387858898c5dc0102bfd2b57fe50707dd002c093a4dc596bf3e7e854f6880

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-01-2023 19:54

Target

8463849a48326c8b46c38717c30a7acc.exe
Size

220KB
MD5

8463849a48326c8b46c38717c30a7acc
SHA1

5c81ea3b2a013b8736872f2d667ba4bc42f4544e
SHA256

101387858898c5dc0102bfd2b57fe50707dd002c093a4dc596bf3e7e854f6880
SHA512

32ecc9c2bc1ae18dae8ac3a832e375faad7d1b426f826872b17d54b766fd2411048960a19c85a2ec8371f3497396514f517216d903074bdb81487dc441247d20
SSDEEP

3072:vLQ3jFFRmQukKxwumnIU2bQ3/Ksg+O/J/Ksg+O/XWf+/Ksg+O/Ti:XQukK6hn3/Ksgz/KsgE+/Ksgk

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1340 1784 WerFault.exe 8463849a48326c8b46c38717c30a7acc.exe

pid	pid_target	process	target process
1340	1784	WerFault.exe	8463849a48326c8b46c38717c30a7acc.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8463849a48326c8b46c38717c30a7acc.exe

description	pid	process	target process
PID 1784 wrote to memory of 1340	1784	8463849a48326c8b46c38717c30a7acc.exe	WerFault.exe
PID 1784 wrote to memory of 1340	1784	8463849a48326c8b46c38717c30a7acc.exe	WerFault.exe
PID 1784 wrote to memory of 1340	1784	8463849a48326c8b46c38717c30a7acc.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8463849a48326c8b46c38717c30a7acc.exe
"C:\Users\Admin\AppData\Local\Temp\8463849a48326c8b46c38717c30a7acc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1784 -s 724
2⤵
- Program crash
PID:1340

memory/1340-56-0x0000000000000000-mapping.dmp

Download
memory/1784-54-0x0000000000810000-0x0000000000848000-memory.dmp

Filesize
224KB

Download
memory/1784-55-0x000007FEFC421000-0x000007FEFC423000-memory.dmp

Filesize
8KB

Download