73519ade03b55bc58d408b4237572cab0ec3571ee34fc991dec6b31710715195

Analysis

max time kernel
140s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20-06-2023 04:57

Target

73519ade03b55bc58d408b4237572cab0ec3571ee34fc991dec6b31710715195.exe
Size

210KB
MD5

3573e393b7d773f1f1854804183d7b44
SHA1

0f1df0a2cd26728b0e0bb3ff61bc0a0e5dfbb396
SHA256

73519ade03b55bc58d408b4237572cab0ec3571ee34fc991dec6b31710715195
SHA512

5c98c6310d0c0d930b363e203437bebe9e561c36a9742c1dee0394dee009d4cdc1c4527aea69793e175168a83b1a5e0e1b8ef47e7efa89dd77899d0f0208b1f9
SSDEEP

3072:yKo3YAVjgDRsqS1IXyCfMia6k5uworjF34y3G+Fn3ImT:ydYAVjesqTy+Bk5/orjFoy3GYnzT

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1040 1088 WerFault.exe 73519ade03b55bc58d408b4237572cab0ec3571ee34fc991dec6b31710715195.exe

pid	pid_target	process	target process
1040	1088	WerFault.exe	73519ade03b55bc58d408b4237572cab0ec3571ee34fc991dec6b31710715195.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

73519ade03b55bc58d408b4237572cab0ec3571ee34fc991dec6b31710715195.exe

description	pid	process	target process
PID 1088 wrote to memory of 1040	1088	73519ade03b55bc58d408b4237572cab0ec3571ee34fc991dec6b31710715195.exe	WerFault.exe
PID 1088 wrote to memory of 1040	1088	73519ade03b55bc58d408b4237572cab0ec3571ee34fc991dec6b31710715195.exe	WerFault.exe
PID 1088 wrote to memory of 1040	1088	73519ade03b55bc58d408b4237572cab0ec3571ee34fc991dec6b31710715195.exe	WerFault.exe
PID 1088 wrote to memory of 1040	1088	73519ade03b55bc58d408b4237572cab0ec3571ee34fc991dec6b31710715195.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\73519ade03b55bc58d408b4237572cab0ec3571ee34fc991dec6b31710715195.exe
"C:\Users\Admin\AppData\Local\Temp\73519ade03b55bc58d408b4237572cab0ec3571ee34fc991dec6b31710715195.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 96
2⤵
- Program crash
PID:1040

memory/1088-55-0x00000000000D0000-0x0000000000125200-memory.dmp

Filesize
340KB

Download
memory/1088-54-0x00000000000D0000-0x0000000000125200-memory.dmp

Filesize
340KB

Download
memory/1088-56-0x00000000000D0000-0x0000000000125200-memory.dmp

Filesize
340KB

Download