188a2bfda4e0fb9bdd1442e667c11dce756126b896c6af511dae079bf1488284

Analysis

max time kernel
26s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22-02-2023 10:01

Target

3904-338-0x0000000000400000-0x0000000000470000-memory.exe
Size

448KB
MD5

7cf519e9ee3e042baf3078411acea213
SHA1

bee208c93b83fee4d9e0e6996ce03db72d195220
SHA256

188a2bfda4e0fb9bdd1442e667c11dce756126b896c6af511dae079bf1488284
SHA512

de9320e640371b3b4adf1d1fe3ae84bd4a0c41e50900079fbaaa43d8ccf94eda64514282b395ef5314164594ad1dbf11d6f05958e6168102a7979f7cf666c4b5
SSDEEP

6144:1zzaqIZItzHsnePQwRi4Y5Werfqtc1D64PQ3yzdLS/62U3tj6+:WZItDawk550c1D64PDVS/6m

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1140 1100 WerFault.exe 3904-338-0x0000000000400000-0x0000000000470000-memory.exe

pid	pid_target	process	target process
1140	1100	WerFault.exe	3904-338-0x0000000000400000-0x0000000000470000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3904-338-0x0000000000400000-0x0000000000470000-memory.exe

description	pid	process	target process
PID 1100 wrote to memory of 1140	1100	3904-338-0x0000000000400000-0x0000000000470000-memory.exe	WerFault.exe
PID 1100 wrote to memory of 1140	1100	3904-338-0x0000000000400000-0x0000000000470000-memory.exe	WerFault.exe
PID 1100 wrote to memory of 1140	1100	3904-338-0x0000000000400000-0x0000000000470000-memory.exe	WerFault.exe
PID 1100 wrote to memory of 1140	1100	3904-338-0x0000000000400000-0x0000000000470000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3904-338-0x0000000000400000-0x0000000000470000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\3904-338-0x0000000000400000-0x0000000000470000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 36
2⤵
- Program crash
PID:1140