988082af2e4d53eef7fe0d69e4c93aaf7ccc1e37ae59d361ac63ea82acc688d5

Analysis

max time kernel
29s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06-03-2023 12:43

Target

988082af2e4d53eef7fe0d69e4c93aaf7ccc1e37ae59d361ac63ea82acc688d5.exe
Size

171KB
MD5

82e2e0fa4bf5becf7415dc2e6fde697d
SHA1

e622808830b75c622924760642a6d556aea3f90c
SHA256

988082af2e4d53eef7fe0d69e4c93aaf7ccc1e37ae59d361ac63ea82acc688d5
SHA512

c58f303d4855369da583181142a54ec0c72cd1f8c697f177bb764b5fc183b9bd6033c137b96e8196bf0cce9f5022c5cc03d6282e65111115fc3ab19a6e855733
SSDEEP

3072:Aa9Jt3huDGRXw6wMzt/cZkLRFTyd4UWKGlE9N7o+sQR8+tz3Mcc79Z/x:AaRVC1MyyLBUfB7oT+tz1c79R

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1676 1236 WerFault.exe 988082af2e4d53eef7fe0d69e4c93aaf7ccc1e37ae59d361ac63ea82acc688d5.exe

pid	pid_target	process	target process
1676	1236	WerFault.exe	988082af2e4d53eef7fe0d69e4c93aaf7ccc1e37ae59d361ac63ea82acc688d5.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

988082af2e4d53eef7fe0d69e4c93aaf7ccc1e37ae59d361ac63ea82acc688d5.exe

description	pid	process	target process
PID 1236 wrote to memory of 1676	1236	988082af2e4d53eef7fe0d69e4c93aaf7ccc1e37ae59d361ac63ea82acc688d5.exe	WerFault.exe
PID 1236 wrote to memory of 1676	1236	988082af2e4d53eef7fe0d69e4c93aaf7ccc1e37ae59d361ac63ea82acc688d5.exe	WerFault.exe
PID 1236 wrote to memory of 1676	1236	988082af2e4d53eef7fe0d69e4c93aaf7ccc1e37ae59d361ac63ea82acc688d5.exe	WerFault.exe
PID 1236 wrote to memory of 1676	1236	988082af2e4d53eef7fe0d69e4c93aaf7ccc1e37ae59d361ac63ea82acc688d5.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\988082af2e4d53eef7fe0d69e4c93aaf7ccc1e37ae59d361ac63ea82acc688d5.exe
"C:\Users\Admin\AppData\Local\Temp\988082af2e4d53eef7fe0d69e4c93aaf7ccc1e37ae59d361ac63ea82acc688d5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 36
2⤵
- Program crash
PID:1676

memory/1236-54-0x0000000000360000-0x00000000003DF000-memory.dmp

Filesize
508KB

Download