b60a49dcb4acf170eea58159cbaa3da92434c3b6a714427b6ff37b650f56368b

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 11:21

Target

b60a49dcb4acf170eea58159cbaa3da92434c3b6a714427b6ff37b650f56368b.exe
Size

602KB
MD5

d64d42eb4c0b9f2f57798da59ab1b3a0
SHA1

ecbcdde64c96e80e3562606ac1ebf92a0d87fb03
SHA256

b60a49dcb4acf170eea58159cbaa3da92434c3b6a714427b6ff37b650f56368b
SHA512

85636191ef8c03cc38ea0bee59c4a664079cb33037a23be0441dc41ba32a2adf9ed771d07916d3df73ff75261a1f5737d5f5e370a5e2f3799e42c8fdd31ed48f
SSDEEP

12288:QTv53McrNBV0RxKXBjPZ0BJs+wRhRT1naazvoMeDO:QTR3MGRZ0BJ0/RT1aa/IO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	1304	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 2012	1304	b60a49dcb4acf170eea58159cbaa3da92434c3b6a714427b6ff37b650f56368b.exe	27
PID 1304 wrote to memory of 2012	1304	b60a49dcb4acf170eea58159cbaa3da92434c3b6a714427b6ff37b650f56368b.exe	27
PID 1304 wrote to memory of 2012	1304	b60a49dcb4acf170eea58159cbaa3da92434c3b6a714427b6ff37b650f56368b.exe	27
PID 1304 wrote to memory of 2012	1304	b60a49dcb4acf170eea58159cbaa3da92434c3b6a714427b6ff37b650f56368b.exe	27

C:\Users\Admin\AppData\Local\Temp\b60a49dcb4acf170eea58159cbaa3da92434c3b6a714427b6ff37b650f56368b.exe
"C:\Users\Admin\AppData\Local\Temp\b60a49dcb4acf170eea58159cbaa3da92434c3b6a714427b6ff37b650f56368b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 36
  2⤵
  - Program crash
  PID:2012

memory/1304-55-0x0000000000620000-0x00000000007440AA-memory.dmp

Filesize
1.1MB

Download