dc86e46d34f1b8a6e1be07b4c534bf968f50f5c2fd4a646a3f466b529e729db9

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
09-02-2023 10:49

Target

dc86e46d34f1b8a6e1be07b4c534bf968f50f5c2fd4a646a3f466b529e729db9.exe
Size

5.3MB
MD5

0aaff36de1cdf918cbf6cfce5cc5617f
SHA1

3bcd39f1972cf4de326e586d004b7f05e3875025
SHA256

dc86e46d34f1b8a6e1be07b4c534bf968f50f5c2fd4a646a3f466b529e729db9
SHA512

6d46a5307f9ec9a0bdd813872d77f6b4823d925478877c7615c3edf29340c537bd4f5bd9e763a12f118035c1ae34283078d454ced885b06bac3415e0dd6d0828
SSDEEP

98304:38YhlXeVL0f9rFAQE9DVC0oDht0xEfJmjTI52J/3CkP9XlDwd5rm:NuVidFyDVCXDht7fJmjkU/nEd5rm

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1964 1692 WerFault.exe dc86e46d34f1b8a6e1be07b4c534bf968f50f5c2fd4a646a3f466b529e729db9.exe

pid	pid_target	process	target process
1964	1692	WerFault.exe	dc86e46d34f1b8a6e1be07b4c534bf968f50f5c2fd4a646a3f466b529e729db9.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

dc86e46d34f1b8a6e1be07b4c534bf968f50f5c2fd4a646a3f466b529e729db9.exe

description	pid	process	target process
PID 1692 wrote to memory of 1964	1692	dc86e46d34f1b8a6e1be07b4c534bf968f50f5c2fd4a646a3f466b529e729db9.exe	WerFault.exe
PID 1692 wrote to memory of 1964	1692	dc86e46d34f1b8a6e1be07b4c534bf968f50f5c2fd4a646a3f466b529e729db9.exe	WerFault.exe
PID 1692 wrote to memory of 1964	1692	dc86e46d34f1b8a6e1be07b4c534bf968f50f5c2fd4a646a3f466b529e729db9.exe	WerFault.exe
PID 1692 wrote to memory of 1964	1692	dc86e46d34f1b8a6e1be07b4c534bf968f50f5c2fd4a646a3f466b529e729db9.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\dc86e46d34f1b8a6e1be07b4c534bf968f50f5c2fd4a646a3f466b529e729db9.exe
"C:\Users\Admin\AppData\Local\Temp\dc86e46d34f1b8a6e1be07b4c534bf968f50f5c2fd4a646a3f466b529e729db9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 212
2⤵
- Program crash
PID:1964

memory/1692-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1692-55-0x0000000000400000-0x0000000001270000-memory.dmp

Filesize
14.4MB

Download
memory/1692-60-0x0000000000400000-0x0000000001270000-memory.dmp

Filesize
14.4MB

Download
memory/1964-59-0x0000000000000000-mapping.dmp

Download