75f21c8d8f68538ae4cf5b632585920cefafa7391a0fb30a29f9226e2ac7c08a

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 18:27

Target

75f21c8d8f68538ae4cf5b632585920cefafa7391a0fb30a29f9226e2ac7c08a.exe
Size

355KB
MD5

5a221d1b4d517d208f35d577e361b4bc
SHA1

b12cba35af20b2f601fd66287421a724d0c8ba1a
SHA256

75f21c8d8f68538ae4cf5b632585920cefafa7391a0fb30a29f9226e2ac7c08a
SHA512

9cb07cd854e62b1118998980763c67bc4f585b6ab9bc62367157d30e2f5faf1471224ada6689fbc889938494243000e59b26800f11f53da98d334ed235b36602
SSDEEP

6144:e5O5sLWx6O4F22FEo2jC1OloNPXW+XDch9XJu+Bd/smxiOoYXRx/2rdL9:egx6zFxSo2W8oNu+TaZ9BVsExoY//4L9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2004	948	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 2004	948	75f21c8d8f68538ae4cf5b632585920cefafa7391a0fb30a29f9226e2ac7c08a.exe	28
PID 948 wrote to memory of 2004	948	75f21c8d8f68538ae4cf5b632585920cefafa7391a0fb30a29f9226e2ac7c08a.exe	28
PID 948 wrote to memory of 2004	948	75f21c8d8f68538ae4cf5b632585920cefafa7391a0fb30a29f9226e2ac7c08a.exe	28
PID 948 wrote to memory of 2004	948	75f21c8d8f68538ae4cf5b632585920cefafa7391a0fb30a29f9226e2ac7c08a.exe	28

C:\Users\Admin\AppData\Local\Temp\75f21c8d8f68538ae4cf5b632585920cefafa7391a0fb30a29f9226e2ac7c08a.exe
"C:\Users\Admin\AppData\Local\Temp\75f21c8d8f68538ae4cf5b632585920cefafa7391a0fb30a29f9226e2ac7c08a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 88
  2⤵
  - Program crash
  PID:2004