562c1a4446d0c27002dc02a0fe034002d10175c157fddee3d2a55cace17dcb16

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26/09/2022, 10:59

Target
521275002022.exe
Size 897KB
Sample220926-m3dvdsaee2
SHA256 562c1a4446d0c27002dc02a0fe034002d10175c157fddee3d2a55cace17dcb16
MD5 f824f7f02ed8475d1b38197a087fc7fc
SHA1 5ca8ab67bfef4fbeffead55bd38821f8cbb80893
SHA512 b43dee6445a64345fc84139f6c49657dcf0abcb34558d775437ddd9dae5a822303337149c5ff01d62c864172216b1807e7e42711ffcdba417ccecdc20a97d719
SSDEEP 12288:WXPvA16nkVf8JBD/ijOsJQf3icUrvn9Z1mqmw5okD0CRtaf8N+nHJRpTeiql:ERJuG3fQ9ZgqmwmkD0gtaf8N+HJR
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1932	536	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1932	536	521275002022.exe	27
PID 536 wrote to memory of 1932	536	521275002022.exe	27
PID 536 wrote to memory of 1932	536	521275002022.exe	27
PID 536 wrote to memory of 1932	536	521275002022.exe	27

C:\Users\Admin\AppData\Local\Temp\521275002022.exe
"C:\Users\Admin\AppData\Local\Temp\521275002022.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 528
  2⤵
  - Program crash
  PID:1932

memory/536-54-0x0000000001320000-0x0000000001406000-memory.dmp

Download