4a6df226fab4b6541156291993fb8376dde6350950f11cd5563a3aa5c7633024

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
29-03-2023 07:32

Target

1576-343-0x0000000000400000-0x000000000046C000-memory.exe
Size

432KB
MD5

276c647f8a990982665999cec22dde61
SHA1

e36fda9a7e88f401fd8e869392a422de83c15aa3
SHA256

4a6df226fab4b6541156291993fb8376dde6350950f11cd5563a3aa5c7633024
SHA512

760ac4e81141043ba15b902748678f7d39b058b54ec48e5105babaa1044251488ee5ecb2680ca5fe7acd0078f26314548dccdbd1b99e8b1a4b41f11a2eb312e4
SSDEEP

6144:7uQRHexuieV+IiVN3f9MY8DWGUQOElBtObJV9DKhoCYLItjCNhuC:7uQRHexuieQ/EbYbxDKKtItjCK

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2020 2004 WerFault.exe 1576-343-0x0000000000400000-0x000000000046C000-memory.exe

pid	pid_target	process	target process
2020	2004	WerFault.exe	1576-343-0x0000000000400000-0x000000000046C000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1576-343-0x0000000000400000-0x000000000046C000-memory.exe

description	pid	process	target process
PID 2004 wrote to memory of 2020	2004	1576-343-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 2004 wrote to memory of 2020	2004	1576-343-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 2004 wrote to memory of 2020	2004	1576-343-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 2004 wrote to memory of 2020	2004	1576-343-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1576-343-0x0000000000400000-0x000000000046C000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1576-343-0x0000000000400000-0x000000000046C000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 36
  2⤵
  - Program crash
  PID:2020