d943a4aabd76582218fd1a9a0a77b2f6a6715b198f9994f0feae6f249b40fdf9

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
22-08-2023 14:44

Target

d943a4aabd76582218fd1a9a0a77b2f6a6715b198f9994f0feae6f249b40fdf9.exe
Size

564KB
MD5

304bbaeb8a573551fb2436f89dc4f237
SHA1

04c144cb3e89982feb56e8727fa116b7537c20d9
SHA256

d943a4aabd76582218fd1a9a0a77b2f6a6715b198f9994f0feae6f249b40fdf9
SHA512

3282ada5f2101ce67f62015444a19443cde28735d918fcdb5d3bf778bab32e3d504988c56402368c5f97c3d20a2d2a631184f0004599a1bc00d7cc84b085c004
SSDEEP

12288:eHZF2b0T/Taa4aygG5VLPItuut24ABT1To:+Raa4ayg6ouuw4s

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2176 1784 WerFault.exe d943a4aabd76582218fd1a9a0a77b2f6a6715b198f9994f0feae6f249b40fdf9.exe

pid	pid_target	process	target process
2176	1784	WerFault.exe	d943a4aabd76582218fd1a9a0a77b2f6a6715b198f9994f0feae6f249b40fdf9.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d943a4aabd76582218fd1a9a0a77b2f6a6715b198f9994f0feae6f249b40fdf9.exe

description	pid	process	target process
PID 1784 wrote to memory of 2176	1784	d943a4aabd76582218fd1a9a0a77b2f6a6715b198f9994f0feae6f249b40fdf9.exe	WerFault.exe
PID 1784 wrote to memory of 2176	1784	d943a4aabd76582218fd1a9a0a77b2f6a6715b198f9994f0feae6f249b40fdf9.exe	WerFault.exe
PID 1784 wrote to memory of 2176	1784	d943a4aabd76582218fd1a9a0a77b2f6a6715b198f9994f0feae6f249b40fdf9.exe	WerFault.exe
PID 1784 wrote to memory of 2176	1784	d943a4aabd76582218fd1a9a0a77b2f6a6715b198f9994f0feae6f249b40fdf9.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\d943a4aabd76582218fd1a9a0a77b2f6a6715b198f9994f0feae6f249b40fdf9.exe
"C:\Users\Admin\AppData\Local\Temp\d943a4aabd76582218fd1a9a0a77b2f6a6715b198f9994f0feae6f249b40fdf9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 124
  2⤵
  - Program crash
  PID:2176