3523bd1f7292ef28e9d9a035456cccfbff802a3f75d22eafff8984e7c5f54ae5

Analysis

max time kernel
141s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31-05-2023 06:31

Target

3523bd1f7292ef28e9d9a035456cccfbff802a3f75d22eafff8984e7c5f54ae5.exe
Size

330KB
MD5

4436aaa47ada4205b673b98b9c12f16b
SHA1

2e459818d91daa9897b7b5b01c84d8276db611f5
SHA256

3523bd1f7292ef28e9d9a035456cccfbff802a3f75d22eafff8984e7c5f54ae5
SHA512

0113aa98138b9096b0cbc5adeabb5ce32906d11591280b26b2e904ec70f55aef7d10c74a3008a4eda770e0f3ac8714582ee6c1d5c8f03d0e30889da9c55ee506
SSDEEP

6144:3WLgAArnzGlV0PySFGe3XeIMPe+M3CzILphE/S6kJFKWrVfSrhFrIzULarO1huqW:3WEVz/aGez1WKS6yjr1SrhYrODuqp

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

920 1736 WerFault.exe 3523bd1f7292ef28e9d9a035456cccfbff802a3f75d22eafff8984e7c5f54ae5.exe

pid	pid_target	process	target process
920	1736	WerFault.exe	3523bd1f7292ef28e9d9a035456cccfbff802a3f75d22eafff8984e7c5f54ae5.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3523bd1f7292ef28e9d9a035456cccfbff802a3f75d22eafff8984e7c5f54ae5.exe

description	pid	process	target process
PID 1736 wrote to memory of 920	1736	3523bd1f7292ef28e9d9a035456cccfbff802a3f75d22eafff8984e7c5f54ae5.exe	WerFault.exe
PID 1736 wrote to memory of 920	1736	3523bd1f7292ef28e9d9a035456cccfbff802a3f75d22eafff8984e7c5f54ae5.exe	WerFault.exe
PID 1736 wrote to memory of 920	1736	3523bd1f7292ef28e9d9a035456cccfbff802a3f75d22eafff8984e7c5f54ae5.exe	WerFault.exe
PID 1736 wrote to memory of 920	1736	3523bd1f7292ef28e9d9a035456cccfbff802a3f75d22eafff8984e7c5f54ae5.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3523bd1f7292ef28e9d9a035456cccfbff802a3f75d22eafff8984e7c5f54ae5.exe
"C:\Users\Admin\AppData\Local\Temp\3523bd1f7292ef28e9d9a035456cccfbff802a3f75d22eafff8984e7c5f54ae5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 88
2⤵
- Program crash
PID:920

memory/1736-54-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download