40c1530a22732c8a949d819e014ccac3101243371d1c392ed1be2c5e2d437d3c

Analysis

max time kernel
26s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27-04-2023 20:08

Target

332-1071-0x0000000001040000-0x0000000001862000-memory.exe
Size

8.1MB
MD5

7829a0aaee822912c1a10cddf933c31d
SHA1

437f4d59275621561adf660b796f7eae5b2c8375
SHA256

40c1530a22732c8a949d819e014ccac3101243371d1c392ed1be2c5e2d437d3c
SHA512

c455f2d540458481bc8bd6ca3543181705a53c9feb36bc992f2a0635e857392af81efdfaab7a525da5927161893750d36dd7cf63cec9fa645f9290fa2312b572
SSDEEP

98304:eiy+j3/y+SE5USLbS3kvMf6V5D6dzRPv2qmxq5xYhtRFXSYweFsWxVTqPkuUXqKX:9rj3KuC0ieqH5xkvXoeFv3qcMm

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1712 1520 WerFault.exe 332-1071-0x0000000001040000-0x0000000001862000-memory.exe

pid	pid_target	process	target process
1712	1520	WerFault.exe	332-1071-0x0000000001040000-0x0000000001862000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

332-1071-0x0000000001040000-0x0000000001862000-memory.exe

description	pid	process	target process
PID 1520 wrote to memory of 1712	1520	332-1071-0x0000000001040000-0x0000000001862000-memory.exe	WerFault.exe
PID 1520 wrote to memory of 1712	1520	332-1071-0x0000000001040000-0x0000000001862000-memory.exe	WerFault.exe
PID 1520 wrote to memory of 1712	1520	332-1071-0x0000000001040000-0x0000000001862000-memory.exe	WerFault.exe
PID 1520 wrote to memory of 1712	1520	332-1071-0x0000000001040000-0x0000000001862000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\332-1071-0x0000000001040000-0x0000000001862000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\332-1071-0x0000000001040000-0x0000000001862000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 36
2⤵
- Program crash
PID:1712