84ce87bc40ac5fe67509431e35158fa5cae9564bb1cc52da7700b7a799f26536

Analysis

max time kernel
20s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 16:40

Target

84ce87bc40ac5fe67509431e35158fa5cae9564bb1cc52da7700b7a799f26536.exe
Size

87KB
MD5

0094693f1cb7c104d08549d6ea90787a
SHA1

f50d193edadf040591d53d728399e119dcf82107
SHA256

84ce87bc40ac5fe67509431e35158fa5cae9564bb1cc52da7700b7a799f26536
SHA512

6ccd1e51a53800a046d706f08c4b1b08a9dc419f8d44134cf2c01737bdfaf701e1102888eb96e7ad7caa545050422dd48323a432de76c79e959d1155c296daa1
SSDEEP

1536:bi9H8b0AYYVSVZVLZphKOcipEyoF7G1DYXYHEw2aAqaqRCimpXoT8l73Qa2BAl3O:nKYCr7bp3gSBl7A3qRCi+Xo67gZA0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
908	2012	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 908	2012	84ce87bc40ac5fe67509431e35158fa5cae9564bb1cc52da7700b7a799f26536.exe	28
PID 2012 wrote to memory of 908	2012	84ce87bc40ac5fe67509431e35158fa5cae9564bb1cc52da7700b7a799f26536.exe	28
PID 2012 wrote to memory of 908	2012	84ce87bc40ac5fe67509431e35158fa5cae9564bb1cc52da7700b7a799f26536.exe	28
PID 2012 wrote to memory of 908	2012	84ce87bc40ac5fe67509431e35158fa5cae9564bb1cc52da7700b7a799f26536.exe	28

C:\Users\Admin\AppData\Local\Temp\84ce87bc40ac5fe67509431e35158fa5cae9564bb1cc52da7700b7a799f26536.exe
"C:\Users\Admin\AppData\Local\Temp\84ce87bc40ac5fe67509431e35158fa5cae9564bb1cc52da7700b7a799f26536.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 168
  2⤵
  - Program crash
  PID:908

memory/908-55-0x0000000000000000-mapping.dmp

Download
memory/2012-54-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download