e527276384d145defb319a3c2adeb52e7825e5a7f8f7459ebc368c31a4018f03

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10-09-2022 06:11

Target

ab80f58dd166cd4f196cf3b62ee67a79.exe
Size

910KB
MD5

ab80f58dd166cd4f196cf3b62ee67a79
SHA1

80935c3e16b27fa4155cf3350e5b474780ce2157
SHA256

e527276384d145defb319a3c2adeb52e7825e5a7f8f7459ebc368c31a4018f03
SHA512

b9f72c372b6a17056731ba2a10a7b650d197dcdb248c607b0e5381258be35f418f5c14e17a9cf871297a0076220a3c34a1845ea069c8ec092d8827c8e65ecd63
SSDEEP

12288:DtwTf4WsfpMOXFmr9MdSo4lhwC1+0PfebD4oJ5Smp/TeGm2qtpRG6YOle:DuTf4WqMOX0r9MUwvafdIfb6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1636 1988 WerFault.exe ab80f58dd166cd4f196cf3b62ee67a79.exe

pid	pid_target	process	target process
1636	1988	WerFault.exe	ab80f58dd166cd4f196cf3b62ee67a79.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ab80f58dd166cd4f196cf3b62ee67a79.exe

description	pid	process	target process
PID 1988 wrote to memory of 1636	1988	ab80f58dd166cd4f196cf3b62ee67a79.exe	WerFault.exe
PID 1988 wrote to memory of 1636	1988	ab80f58dd166cd4f196cf3b62ee67a79.exe	WerFault.exe
PID 1988 wrote to memory of 1636	1988	ab80f58dd166cd4f196cf3b62ee67a79.exe	WerFault.exe
PID 1988 wrote to memory of 1636	1988	ab80f58dd166cd4f196cf3b62ee67a79.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ab80f58dd166cd4f196cf3b62ee67a79.exe
"C:\Users\Admin\AppData\Local\Temp\ab80f58dd166cd4f196cf3b62ee67a79.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 584
2⤵
- Program crash
PID:1636

memory/1636-56-0x0000000000000000-mapping.dmp

Download
memory/1988-54-0x0000000000910000-0x00000000009F8000-memory.dmp

Filesize
928KB

Download
memory/1988-55-0x00000000005D0000-0x0000000000656000-memory.dmp

Filesize
536KB

Download