0076a6e6588698ee14f6f1f01466fd6a5470e005d3c4dbf61f9099f528484754

Analysis

max time kernel
47s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 20:14

Target

0076a6e6588698ee14f6f1f01466fd6a5470e005d3c4dbf61f9099f528484754.exe
Size

80KB
MD5

10e17544e063bbb6471f11c1aa2e1f61
SHA1

8657bb76badd319621d1a7d306d14cbdfddf4c58
SHA256

0076a6e6588698ee14f6f1f01466fd6a5470e005d3c4dbf61f9099f528484754
SHA512

67e66d13a5cfd4738724752008272111c2613a6d6d06dcf9cf9a890039150e12d8505427c9f334b3ca1c4cdca335ed2e5bf15b6d5aae22dcc5f3d2dd8767f357
SSDEEP

1536:ScJ9oLCze57WxKKu4czmEd/2djyfZiqv43LCmaG82hW8fPL:5SMxKKuHmI/A00qA3Wq8vYL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1532	1460	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1532	1460	0076a6e6588698ee14f6f1f01466fd6a5470e005d3c4dbf61f9099f528484754.exe	27
PID 1460 wrote to memory of 1532	1460	0076a6e6588698ee14f6f1f01466fd6a5470e005d3c4dbf61f9099f528484754.exe	27
PID 1460 wrote to memory of 1532	1460	0076a6e6588698ee14f6f1f01466fd6a5470e005d3c4dbf61f9099f528484754.exe	27
PID 1460 wrote to memory of 1532	1460	0076a6e6588698ee14f6f1f01466fd6a5470e005d3c4dbf61f9099f528484754.exe	27

C:\Users\Admin\AppData\Local\Temp\0076a6e6588698ee14f6f1f01466fd6a5470e005d3c4dbf61f9099f528484754.exe
"C:\Users\Admin\AppData\Local\Temp\0076a6e6588698ee14f6f1f01466fd6a5470e005d3c4dbf61f9099f528484754.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 36
  2⤵
  - Program crash
  PID:1532

memory/1460-55-0x0000000000400000-0x0000000000425E52-memory.dmp

Filesize
151KB

Download