28a72f3a983f057c221c2f21bba14afac6c0f554860dccbb5669392399086829

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 00:24

Target

28a72f3a983f057c221c2f21bba14afac6c0f554860dccbb5669392399086829.exe
Size

785KB
MD5

249548114a369810d4aeb95ed6f05d1b
SHA1

e6e5926d001565576228ea23f5a7451581d31fe9
SHA256

28a72f3a983f057c221c2f21bba14afac6c0f554860dccbb5669392399086829
SHA512

b39abf298fada87b15528a24b79fc8169bbc9fad23bcddd0d98c2c82d1f9773fbe4b815ebc7f8d9389c4016891b70a9d20f7b897e44d794680e2153c2073c62b
SSDEEP

12288:dj4UOK7//Sb8vuPHaVo8Rb23TDpLYkWqIpgZMN9R2yc/3Ns5Ez4YYleljvCSqwEd:V74P6nb4TDpLYkwgu3R2NN5ETulEEO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1748	1492	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1748	1492	28a72f3a983f057c221c2f21bba14afac6c0f554860dccbb5669392399086829.exe	27
PID 1492 wrote to memory of 1748	1492	28a72f3a983f057c221c2f21bba14afac6c0f554860dccbb5669392399086829.exe	27
PID 1492 wrote to memory of 1748	1492	28a72f3a983f057c221c2f21bba14afac6c0f554860dccbb5669392399086829.exe	27
PID 1492 wrote to memory of 1748	1492	28a72f3a983f057c221c2f21bba14afac6c0f554860dccbb5669392399086829.exe	27

C:\Users\Admin\AppData\Local\Temp\28a72f3a983f057c221c2f21bba14afac6c0f554860dccbb5669392399086829.exe
"C:\Users\Admin\AppData\Local\Temp\28a72f3a983f057c221c2f21bba14afac6c0f554860dccbb5669392399086829.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 44
  2⤵
  - Program crash
  PID:1748

memory/1492-55-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download