ddb0aa14f00f562d9e8a3356fded94ee24d458a6fe11269df63ec6844274e43c

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10-04-2023 06:06

Target

1014/5edbc4d43f93a21d6cb19cbcccdcec5b7c6a576446e0a962d174610cf82ee64b.exe
Size

59KB
MD5

017b72650ca6d62040793a323c6c4781
SHA1

1a883642ccb37098f8e1690c239658979ddb45c7
SHA256

5edbc4d43f93a21d6cb19cbcccdcec5b7c6a576446e0a962d174610cf82ee64b
SHA512

540588ab8aa3f4e4fe947c6233951fe58eefeba1f8fe3063691c7af4b7c10a43d57cb81c8f1a69e7b45fb926c8478bfff2f80bc61ba295633d4e6f71518cb13f
SSDEEP

768:KRh6F3ytu3whIIcV0jaattabYK15ZEvK9e8gTBNKwWUMt8j0a9XBDm:Ktu3whIc/6c5Mtq9XB

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

316 1568 WerFault.exe 5edbc4d43f93a21d6cb19cbcccdcec5b7c6a576446e0a962d174610cf82ee64b.exe

pid	pid_target	process	target process
316	1568	WerFault.exe	5edbc4d43f93a21d6cb19cbcccdcec5b7c6a576446e0a962d174610cf82ee64b.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5edbc4d43f93a21d6cb19cbcccdcec5b7c6a576446e0a962d174610cf82ee64b.exe

description	pid	process	target process
PID 1568 wrote to memory of 316	1568	5edbc4d43f93a21d6cb19cbcccdcec5b7c6a576446e0a962d174610cf82ee64b.exe	WerFault.exe
PID 1568 wrote to memory of 316	1568	5edbc4d43f93a21d6cb19cbcccdcec5b7c6a576446e0a962d174610cf82ee64b.exe	WerFault.exe
PID 1568 wrote to memory of 316	1568	5edbc4d43f93a21d6cb19cbcccdcec5b7c6a576446e0a962d174610cf82ee64b.exe	WerFault.exe
PID 1568 wrote to memory of 316	1568	5edbc4d43f93a21d6cb19cbcccdcec5b7c6a576446e0a962d174610cf82ee64b.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1014\5edbc4d43f93a21d6cb19cbcccdcec5b7c6a576446e0a962d174610cf82ee64b.exe
"C:\Users\Admin\AppData\Local\Temp\1014\5edbc4d43f93a21d6cb19cbcccdcec5b7c6a576446e0a962d174610cf82ee64b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 132
2⤵
- Program crash
PID:316