36872d013e7ce3910090a828c7ba793b7fb8559ffc086c3609876cd10b44ebe1

Analysis

max time kernel
71s
max time network
75s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
09-07-2023 16:25

Target

b42d63e16b2fe6exeexeexeex.exe
Size

335KB
MD5

b42d63e16b2fe616c7c72d3ac42c16f8
SHA1

031e8658567b3023dddbf5b470dc33779c467bad
SHA256

36872d013e7ce3910090a828c7ba793b7fb8559ffc086c3609876cd10b44ebe1
SHA512

73ac68fd391353ca07ab4469b735c8458c17648843ee0f3ddfc776693c82abe9c079a03087f2f57f3a100b741006a7e1f21bce532d9782abc3469d0a2ee69284
SSDEEP

6144:qtUGfUWOeEBUEhLkXj3zRG6yLQ/UNP4H2CiTTY10qhh4tAjrt:qtUGfVwUFzRG6EQ0POfiTTI0qYAjrt

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2360 2056 WerFault.exe b42d63e16b2fe6exeexeexeex.exe

pid	pid_target	process	target process
2360	2056	WerFault.exe	b42d63e16b2fe6exeexeexeex.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b42d63e16b2fe6exeexeexeex.exe

description	pid	process	target process
PID 2056 wrote to memory of 2360	2056	b42d63e16b2fe6exeexeexeex.exe	WerFault.exe
PID 2056 wrote to memory of 2360	2056	b42d63e16b2fe6exeexeexeex.exe	WerFault.exe
PID 2056 wrote to memory of 2360	2056	b42d63e16b2fe6exeexeexeex.exe	WerFault.exe
PID 2056 wrote to memory of 2360	2056	b42d63e16b2fe6exeexeexeex.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\b42d63e16b2fe6exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\b42d63e16b2fe6exeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 120
2⤵
- Program crash
PID:2360