c193539b7105929e38e17105ac45678cc790ebc43897c75a3437b6af491bb896

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 14:18

Target

c193539b7105929e38e17105ac45678cc790ebc43897c75a3437b6af491bb896.exe
Size

60KB
MD5

dd9effa6c443e0cc11a4bcd382c13551
SHA1

919d97186d25619bdef776453feac870aa35889d
SHA256

c193539b7105929e38e17105ac45678cc790ebc43897c75a3437b6af491bb896
SHA512

ebdbb1e59634f253765ac0894e97d9e5d8df38a86394300c605afcc338ec35e3f262428dce0719ba5a9759037784115f6588f216b7465a0458915f9620ce1465
SSDEEP

1536:aA9Ko37AfQJAYCidJk06Qt6h5uQxnybjTUWv9pB:39KeAcAyX6V3peTUWv9pB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1536	1388	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1536	1388	c193539b7105929e38e17105ac45678cc790ebc43897c75a3437b6af491bb896.exe	26
PID 1388 wrote to memory of 1536	1388	c193539b7105929e38e17105ac45678cc790ebc43897c75a3437b6af491bb896.exe	26
PID 1388 wrote to memory of 1536	1388	c193539b7105929e38e17105ac45678cc790ebc43897c75a3437b6af491bb896.exe	26
PID 1388 wrote to memory of 1536	1388	c193539b7105929e38e17105ac45678cc790ebc43897c75a3437b6af491bb896.exe	26

C:\Users\Admin\AppData\Local\Temp\c193539b7105929e38e17105ac45678cc790ebc43897c75a3437b6af491bb896.exe
"C:\Users\Admin\AppData\Local\Temp\c193539b7105929e38e17105ac45678cc790ebc43897c75a3437b6af491bb896.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 36
  2⤵
  - Program crash
  PID:1536

memory/1388-55-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download