e55d207fb8eb55a63e9119fab33f0dc6d136b1dd49028a910ebcae9a27725a2f

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
29-03-2023 09:58

Target

1808-342-0x0000000000400000-0x000000000046C000-memory.exe
Size

432KB
MD5

90e73d6ea3a4a1de961048a69fd3e27f
SHA1

a153e361cee8461eb8ba9e9999c05cea2b45c80a
SHA256

e55d207fb8eb55a63e9119fab33f0dc6d136b1dd49028a910ebcae9a27725a2f
SHA512

1f4e7237be50ec21e55c175617726fc9fd0ae0d6199c63a025bfde47b87234643845d8e0482d2d3ca7af9426be764b94656335b984be8cbec12cc439ab2b2d3b
SSDEEP

6144:7uQRHexuieV+IiVN3f9MY8DWGUQOElBtObJV9DKhoCYLItjCNhuC:7uQRHexuieQ/EbYbxDKK9ItjCK

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1728 288 WerFault.exe 1808-342-0x0000000000400000-0x000000000046C000-memory.exe

pid	pid_target	process	target process
1728	288	WerFault.exe	1808-342-0x0000000000400000-0x000000000046C000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1808-342-0x0000000000400000-0x000000000046C000-memory.exe

description	pid	process	target process
PID 288 wrote to memory of 1728	288	1808-342-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 288 wrote to memory of 1728	288	1808-342-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 288 wrote to memory of 1728	288	1808-342-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 288 wrote to memory of 1728	288	1808-342-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1808-342-0x0000000000400000-0x000000000046C000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1808-342-0x0000000000400000-0x000000000046C000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 288 -s 36
  2⤵
  - Program crash
  PID:1728