bf19c7ee8017f835c21d96ce75f381d3ed9863faae8569b2055f0091a2cd4510

Analysis

max time kernel
141s
max time network
31s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
24-06-2023 18:58

Target

bf19c7ee8017f835c21d96ce75f381d3ed9863faae8569b2055f0091a2cd4510.exe
Size

3.2MB
MD5

00e7fb9c6eaf18f430b2b4ac83b4d843
SHA1

8507ffbe3b24d54350ec740c8fcae9d120dfecf4
SHA256

bf19c7ee8017f835c21d96ce75f381d3ed9863faae8569b2055f0091a2cd4510
SHA512

65a662549b0063d6d1382d012331f07c1cdbd848d77819a9d3e7dff0a45fc6fc6b1ef28d33719cebf8a14814b77cfba535f328fb6cf2007ab2317a529c409553
SSDEEP

98304:Jz+P56qngdxddUEETwF8XmVT5TOegN7hU5Y72:Jz+EYCxddHDF8X2+N7+5Q

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1648 1984 WerFault.exe bf19c7ee8017f835c21d96ce75f381d3ed9863faae8569b2055f0091a2cd4510.exe

pid	pid_target	process	target process
1648	1984	WerFault.exe	bf19c7ee8017f835c21d96ce75f381d3ed9863faae8569b2055f0091a2cd4510.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bf19c7ee8017f835c21d96ce75f381d3ed9863faae8569b2055f0091a2cd4510.exe

description	pid	process	target process
PID 1984 wrote to memory of 1648	1984	bf19c7ee8017f835c21d96ce75f381d3ed9863faae8569b2055f0091a2cd4510.exe	WerFault.exe
PID 1984 wrote to memory of 1648	1984	bf19c7ee8017f835c21d96ce75f381d3ed9863faae8569b2055f0091a2cd4510.exe	WerFault.exe
PID 1984 wrote to memory of 1648	1984	bf19c7ee8017f835c21d96ce75f381d3ed9863faae8569b2055f0091a2cd4510.exe	WerFault.exe
PID 1984 wrote to memory of 1648	1984	bf19c7ee8017f835c21d96ce75f381d3ed9863faae8569b2055f0091a2cd4510.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bf19c7ee8017f835c21d96ce75f381d3ed9863faae8569b2055f0091a2cd4510.exe
"C:\Users\Admin\AppData\Local\Temp\bf19c7ee8017f835c21d96ce75f381d3ed9863faae8569b2055f0091a2cd4510.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 216
2⤵
- Program crash
PID:1648

memory/1984-54-0x0000000000400000-0x000000000106A000-memory.dmp

Filesize
12.4MB

Download
memory/1984-55-0x0000000000400000-0x000000000106A000-memory.dmp

Filesize
12.4MB

Download
memory/1984-56-0x0000000000400000-0x000000000106A000-memory.dmp

Filesize
12.4MB

Download
memory/1984-57-0x0000000000400000-0x000000000106A000-memory.dmp

Filesize
12.4MB

Download
memory/1984-58-0x0000000000400000-0x000000000106A000-memory.dmp

Filesize
12.4MB

Download