90e3301b294e929ff02fd421fbfde72558b5983e18f6447f57b0d9710136a4d3

Analysis

max time kernel
29s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24-04-2023 00:45

Target

3076-473-0x0000000000400000-0x000000000046C000-memory.exe
Size

432KB
MD5

e18726c12309e5f0f3a148cc16ab4f11
SHA1

3b7701a7a7f5751b9b9f9bb672ee1d8b6963d86a
SHA256

90e3301b294e929ff02fd421fbfde72558b5983e18f6447f57b0d9710136a4d3
SHA512

f9cd26722eafffbbf3e2a713c6b30416bb1363e84b90eb69b4538138af09a7b32388348e8cddd699eec6a3e47b186d3c9283530f4a4dde2016bf6ed556052ca6
SSDEEP

6144:z66+X5aG78XAIn2RN2iy3g8UpioUb65qJfbri5bMuCV4a3SqdBFJVkShVH:z6HX5aG782ook65G/id5CV53vZVk

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1868 1848 WerFault.exe 3076-473-0x0000000000400000-0x000000000046C000-memory.exe

pid	pid_target	process	target process
1868	1848	WerFault.exe	3076-473-0x0000000000400000-0x000000000046C000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3076-473-0x0000000000400000-0x000000000046C000-memory.exe

description	pid	process	target process
PID 1848 wrote to memory of 1868	1848	3076-473-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 1848 wrote to memory of 1868	1848	3076-473-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 1848 wrote to memory of 1868	1848	3076-473-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe
PID 1848 wrote to memory of 1868	1848	3076-473-0x0000000000400000-0x000000000046C000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3076-473-0x0000000000400000-0x000000000046C000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\3076-473-0x0000000000400000-0x000000000046C000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 36
2⤵
- Program crash
PID:1868