631f70c7a6480444c45db4680d10743ec13a40d5b87e0174467a33d527f114b3

Analysis

max time kernel
140s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-06-2023 19:37

Target

631f70c7a6480444c45db4680d10743ec13a40d5b87e0174467a33d527f114b3.exe
Size

1.3MB
MD5

4da2bd385db400c1ccbf47963cfeebc6
SHA1

9c83769d797248469132b0cb3e11446a9f4ebda3
SHA256

631f70c7a6480444c45db4680d10743ec13a40d5b87e0174467a33d527f114b3
SHA512

121bb0b448d00a590bbdf6b65479dc296f35e84bedcc6a8c6e27e59c5f15d606d4d81048a41856c8a80b0878ed474b2ace352b2a22154a31993f43862cd6fb41
SSDEEP

24576:t+klP2MoXAl6RMh1ruX4sMxfsL8ow52Wpjd659zPxb:hoQSMh1r8ifmDN2B6/zPxb

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

940 1108 WerFault.exe 631f70c7a6480444c45db4680d10743ec13a40d5b87e0174467a33d527f114b3.exe

pid	pid_target	process	target process
940	1108	WerFault.exe	631f70c7a6480444c45db4680d10743ec13a40d5b87e0174467a33d527f114b3.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

631f70c7a6480444c45db4680d10743ec13a40d5b87e0174467a33d527f114b3.exe

description	pid	process	target process
PID 1108 wrote to memory of 940	1108	631f70c7a6480444c45db4680d10743ec13a40d5b87e0174467a33d527f114b3.exe	WerFault.exe
PID 1108 wrote to memory of 940	1108	631f70c7a6480444c45db4680d10743ec13a40d5b87e0174467a33d527f114b3.exe	WerFault.exe
PID 1108 wrote to memory of 940	1108	631f70c7a6480444c45db4680d10743ec13a40d5b87e0174467a33d527f114b3.exe	WerFault.exe
PID 1108 wrote to memory of 940	1108	631f70c7a6480444c45db4680d10743ec13a40d5b87e0174467a33d527f114b3.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\631f70c7a6480444c45db4680d10743ec13a40d5b87e0174467a33d527f114b3.exe
"C:\Users\Admin\AppData\Local\Temp\631f70c7a6480444c45db4680d10743ec13a40d5b87e0174467a33d527f114b3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 220
2⤵
- Program crash
PID:940

memory/1108-54-0x0000000000200000-0x00000000004EE000-memory.dmp

Filesize
2.9MB

Download