599da9c06bb0c71392e4836a21e0a2e68db966a29e806d83608e818af40885d5

Analysis

max time kernel
54s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
10-02-2023 19:09

Target

599da9c06bb0c71392e4836a21e0a2e68db966a29e806d83608e818af40885d5.exe
Size

4.3MB
MD5

ae83f8b521d7ed9ed3b4b8552eaedca5
SHA1

26b43c62fa9b3edbccd47ba8965798505772a758
SHA256

599da9c06bb0c71392e4836a21e0a2e68db966a29e806d83608e818af40885d5
SHA512

10d16b99472805aa3352c94b875bb19b50d38ab57781b32c2aeb6d9654160f10188e35e53194c96d26b3fa038d6a23e40cd6eeac2f9af761b8283fc88796f05d
SSDEEP

98304:D1ijlRnWUcXlbs9UDFBqP2wSYOtgf+3S:pIK1I9UDU28OtgfcS

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1260 784 WerFault.exe 599da9c06bb0c71392e4836a21e0a2e68db966a29e806d83608e818af40885d5.exe

pid	pid_target	process	target process
1260	784	WerFault.exe	599da9c06bb0c71392e4836a21e0a2e68db966a29e806d83608e818af40885d5.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

599da9c06bb0c71392e4836a21e0a2e68db966a29e806d83608e818af40885d5.exe

description	pid	process	target process
PID 784 wrote to memory of 1260	784	599da9c06bb0c71392e4836a21e0a2e68db966a29e806d83608e818af40885d5.exe	WerFault.exe
PID 784 wrote to memory of 1260	784	599da9c06bb0c71392e4836a21e0a2e68db966a29e806d83608e818af40885d5.exe	WerFault.exe
PID 784 wrote to memory of 1260	784	599da9c06bb0c71392e4836a21e0a2e68db966a29e806d83608e818af40885d5.exe	WerFault.exe
PID 784 wrote to memory of 1260	784	599da9c06bb0c71392e4836a21e0a2e68db966a29e806d83608e818af40885d5.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\599da9c06bb0c71392e4836a21e0a2e68db966a29e806d83608e818af40885d5.exe
"C:\Users\Admin\AppData\Local\Temp\599da9c06bb0c71392e4836a21e0a2e68db966a29e806d83608e818af40885d5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 784 -s 232
2⤵
- Program crash
PID:1260

memory/784-54-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download
memory/784-55-0x0000000000400000-0x0000000001A0C000-memory.dmp

Filesize
22.0MB

Download
memory/784-56-0x0000000000400000-0x0000000001A0C000-memory.dmp

Filesize
22.0MB

Download
memory/784-57-0x0000000000400000-0x0000000001A0C000-memory.dmp

Filesize
22.0MB

Download
memory/784-58-0x0000000000400000-0x0000000001A0C000-memory.dmp

Filesize
22.0MB

Download
memory/784-60-0x0000000000400000-0x0000000001A0C000-memory.dmp

Filesize
22.0MB

Download
memory/1260-59-0x0000000000000000-mapping.dmp

Download