31fcc1a7c79fa0e760d81e479154824551be394658821275380c9fc45343ae22

Analysis

max time kernel
13s
max time network
20s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
13-08-2023 18:33

Target

1.exe
Size

582KB
MD5

5bbe49ada7ef535b87bd1e3c3d2b42c3
SHA1

1e94057198bdf893683d30591601aa88f51eed49
SHA256

7be2a5923ba5e4acb9f1e5eee42c04b2b6620c82efe013e751415a495590895d
SHA512

f859b1efc80ddcfe3f54aae4ebb4a3f4612a8a4b1ecd0b965f1e65f8decf8018999ce48e32a71515f78bc223c24815aa8bd645b517947d65227e083d0ff9c45d
SSDEEP

12288:S1lqDbsmSxn3Iv9XyePFQkLkRvJSA5V40mjz5Auz6r0Sn:i4Db7Sxn3IvrRgRRSwL4tz6rd

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2376 2364 WerFault.exe 1.exe

pid	pid_target	process	target process
2376	2364	WerFault.exe	1.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1.exe

description	pid	process	target process
PID 2364 wrote to memory of 2376	2364	1.exe	WerFault.exe
PID 2364 wrote to memory of 2376	2364	1.exe	WerFault.exe
PID 2364 wrote to memory of 2376	2364	1.exe	WerFault.exe
PID 2364 wrote to memory of 2376	2364	1.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 560
2⤵
- Program crash
PID:2376

memory/2364-53-0x0000000000AA0000-0x0000000000AE0000-memory.dmp

Filesize
256KB

Download
memory/2364-54-0x0000000074420000-0x0000000074B0E000-memory.dmp

Filesize
6.9MB

Download
memory/2364-55-0x00000000048B0000-0x00000000048F0000-memory.dmp

Filesize
256KB

Download
memory/2364-56-0x0000000074420000-0x0000000074B0E000-memory.dmp

Filesize
6.9MB

Download
memory/2364-57-0x00000000048B0000-0x00000000048F0000-memory.dmp

Filesize
256KB

Download