380d632714f32150161dac50eafd0f1c664583f30d08f2e4ec5e31464601c016

Analysis

max time kernel
42s
max time network
104s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08/09/2022, 19:00

Target

TRANSFER.exe
Size

420KB
MD5

ce33da59c11c5c33184d1e340a0279b3
SHA1

027438681ac0485363de8b9701ddb4b4571cfe93
SHA256

380d632714f32150161dac50eafd0f1c664583f30d08f2e4ec5e31464601c016
SHA512

96097a14d349ebfcd753c887377a16650addbf1c05ea23a768fb4557de8e6724feae185ba0f77e6e8d693e569f30ef32e4018639ef2bd0e5aa3c10066bd26f5c
SSDEEP

6144:24XHCKrhC7vlQSAVWAtMEwmQGFLSf8Xfpu8dGUqsGyg5E8ltoQZpcfclLpK/UDp:BCKrEe7W8FLSgu8cUqvlCQMfqLpQ2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	1944	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1728	1944	TRANSFER.exe	28
PID 1944 wrote to memory of 1728	1944	TRANSFER.exe	28
PID 1944 wrote to memory of 1728	1944	TRANSFER.exe	28
PID 1944 wrote to memory of 1728	1944	TRANSFER.exe	28

C:\Users\Admin\AppData\Local\Temp\TRANSFER.exe
"C:\Users\Admin\AppData\Local\Temp\TRANSFER.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 552
  2⤵
  - Program crash
  PID:1728

memory/1944-54-0x0000000000FE0000-0x0000000001050000-memory.dmp

Filesize
448KB

Download
memory/1944-55-0x0000000000C20000-0x0000000000C8A000-memory.dmp

Filesize
424KB

Download