c8834fc1f6037172a395566c9ab93b568ea24456b858747cca70b0d1ea979767

Analysis

max time kernel
28s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
28-03-2023 15:24

Target

5080-445-0x0000000000400000-0x000000000046C000-memory.exe
Size

432KB
MD5

ce20d911ab89f776b4a8a76c3157f0b4
SHA1

eff7fa5d5f7fab4acf8e759669fa7ea1f2d3be3e
SHA256

c8834fc1f6037172a395566c9ab93b568ea24456b858747cca70b0d1ea979767
SHA512

3eb9bd52ab1f50f9e888461234fdfa91c7b08c8309122692f47827bd43fb8460a6e9f24c750ad546f9f9cabe2b75e15ccbeef5c20c9e39a4832be18d5febc630
SSDEEP

6144:7uQRHexuieV+IiVN3f9MY8DWGUQOElBtObJV9DKhoCYoRItjCNhul:7uQRHexuieQ/EbYbxDKK2RItjCK

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1608 1512 WerFault.exe 5080-445-0x0000000000400000-0x000000000046C000-memory.exe

pid	pid_target	process	target process
1608	1512	WerFault.exe	5080-445-0x0000000000400000-0x000000000046C000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5080-445-0x0000000000400000-0x000000000046C000-memory.exe

description	pid	process	target process
PID 1512 wrote to memory of 1608	1512	5080-445-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 1512 wrote to memory of 1608	1512	5080-445-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 1512 wrote to memory of 1608	1512	5080-445-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 1512 wrote to memory of 1608	1512	5080-445-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5080-445-0x0000000000400000-0x000000000046C000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\5080-445-0x0000000000400000-0x000000000046C000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 36
2⤵
- Program crash
PID:1608