30bd59d717356c72008e748c988b6c52de104bb67e72a5a01db05ee30e76d88b

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05-05-2023 16:44

Target

292-173-0x0000000000830000-0x0000000001052000-memory.exe
Size

8.1MB
MD5

98ca1f8c9533bd316f455239305b3030
SHA1

bcd2d1f4e6999cb65c95798d6a9542fff1a57ca5
SHA256

30bd59d717356c72008e748c988b6c52de104bb67e72a5a01db05ee30e76d88b
SHA512

c6627cdd4f12e3c95e9ec1ea3c0a56c90088ab5081734c28d54313ad854e78c1fe91c51711a04c273b7bca85407c26493767a8e0e503a37d2f6cfc638ed17691
SSDEEP

98304:Giy+j3/y+SE5USLbS3k3fI2CKd0nlgHPv2qmxqt5YhtRFXSYweFsWxVTqPkuUXqm:1rj3KuC0teqHt5kvXoeFv3qcMm

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1224 2044 WerFault.exe 292-173-0x0000000000830000-0x0000000001052000-memory.exe

pid	pid_target	process	target process
1224	2044	WerFault.exe	292-173-0x0000000000830000-0x0000000001052000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

292-173-0x0000000000830000-0x0000000001052000-memory.exe

description	pid	process	target process
PID 2044 wrote to memory of 1224	2044	292-173-0x0000000000830000-0x0000000001052000-memory.exe	WerFault.exe
PID 2044 wrote to memory of 1224	2044	292-173-0x0000000000830000-0x0000000001052000-memory.exe	WerFault.exe
PID 2044 wrote to memory of 1224	2044	292-173-0x0000000000830000-0x0000000001052000-memory.exe	WerFault.exe
PID 2044 wrote to memory of 1224	2044	292-173-0x0000000000830000-0x0000000001052000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\292-173-0x0000000000830000-0x0000000001052000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\292-173-0x0000000000830000-0x0000000001052000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 36
2⤵
- Program crash
PID:1224