3136f4d604f56a324f5874d87215d18cca20388e161ebddec0aa53dccf70c547

Analysis

max time kernel
140s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
20-02-2023 18:38

Target

3136f4d604f56a324f5874d87215d18cca20388e161ebddec0aa53dccf70c547.exe
Size

909KB
MD5

2daf9461a8bf43c241ff4259bfaee0fa
SHA1

a1250ba3ebd88591b5d9367d689a23803cf4678b
SHA256

3136f4d604f56a324f5874d87215d18cca20388e161ebddec0aa53dccf70c547
SHA512

87d0c8476e21d8871b646dd50e1e185bf16710fecf11cdda6743c050d863b36ed8999aa40c45c5a4dff89da0421af7399511c7bd7b7d86604968691ce309fd18
SSDEEP

24576:iPTCspPGwK9Ao48W6N8bsBOwxAoUSITuwR:o+yGJefLwxAoUSI

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

948 1532 WerFault.exe 3136f4d604f56a324f5874d87215d18cca20388e161ebddec0aa53dccf70c547.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

3136f4d604f56a324f5874d87215d18cca20388e161ebddec0aa53dccf70c547.exe

pid process

1532 3136f4d604f56a324f5874d87215d18cca20388e161ebddec0aa53dccf70c547.exe

pid	pid_target	process	target process
948	1532	WerFault.exe	3136f4d604f56a324f5874d87215d18cca20388e161ebddec0aa53dccf70c547.exe

pid	process
1532	3136f4d604f56a324f5874d87215d18cca20388e161ebddec0aa53dccf70c547.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3136f4d604f56a324f5874d87215d18cca20388e161ebddec0aa53dccf70c547.exe

description	pid	process	target process
PID 1532 wrote to memory of 948	1532	3136f4d604f56a324f5874d87215d18cca20388e161ebddec0aa53dccf70c547.exe	WerFault.exe
PID 1532 wrote to memory of 948	1532	3136f4d604f56a324f5874d87215d18cca20388e161ebddec0aa53dccf70c547.exe	WerFault.exe
PID 1532 wrote to memory of 948	1532	3136f4d604f56a324f5874d87215d18cca20388e161ebddec0aa53dccf70c547.exe	WerFault.exe
PID 1532 wrote to memory of 948	1532	3136f4d604f56a324f5874d87215d18cca20388e161ebddec0aa53dccf70c547.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 400
2⤵
- Program crash
PID:948

memory/1532-54-0x0000000000400000-0x000000000088E000-memory.dmp

Filesize
4.6MB

Download
memory/1532-56-0x0000000000400000-0x000000000088E000-memory.dmp

Filesize
4.6MB

Download
memory/1532-55-0x0000000000400000-0x000000000088E000-memory.dmp

Filesize
4.6MB

Download
memory/1532-57-0x0000000000400000-0x000000000088E000-memory.dmp

Filesize
4.6MB

Download
memory/1532-58-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download