77a575672e3fa7533b45e35038c23636dd34ad9676891e771068008e28043160

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31-03-2023 01:40

Target

2560-266-0x0000000000400000-0x000000000046C000-memory.exe
Size

432KB
MD5

ec4548ed0f26853e87c5f5c515e30d58
SHA1

a1cf4112ec67fa15c01165257eca39ec7d2a2ab9
SHA256

77a575672e3fa7533b45e35038c23636dd34ad9676891e771068008e28043160
SHA512

cc7e1d29760f9decfa30246f0ac13c7a01773727fd6648efea1c9d350e790f1d4b8707d1bf4f19eb683170b291136ee4a0d771a74f3759e7d66119d18f6cc1a6
SSDEEP

6144:7uQRHexuieV+IiVN3f9MY8DWGUQOElBtObJV9DKhoCYLItjCNhuC:7uQRHexuieQ/EbYbxDKKtItjCK

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2028 1060 WerFault.exe 2560-266-0x0000000000400000-0x000000000046C000-memory.exe

pid	pid_target	process	target process
2028	1060	WerFault.exe	2560-266-0x0000000000400000-0x000000000046C000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2560-266-0x0000000000400000-0x000000000046C000-memory.exe

description	pid	process	target process
PID 1060 wrote to memory of 2028	1060	2560-266-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 1060 wrote to memory of 2028	1060	2560-266-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 1060 wrote to memory of 2028	1060	2560-266-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 1060 wrote to memory of 2028	1060	2560-266-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2560-266-0x0000000000400000-0x000000000046C000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2560-266-0x0000000000400000-0x000000000046C000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 36
2⤵
- Program crash
PID:2028