51bd237aa0b029f6c856804522ae868cf9bdce1fd50827887321ba22d4bc293a

Analysis

max time kernel
38s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 18:15

Target

51bd237aa0b029f6c856804522ae868cf9bdce1fd50827887321ba22d4bc293a.exe
Size

398KB
MD5

624c35c8b747bf2a56da557108e50610
SHA1

1cbfbcee5866939203f6e2f10aa5432387690e89
SHA256

51bd237aa0b029f6c856804522ae868cf9bdce1fd50827887321ba22d4bc293a
SHA512

b77d39541d9d2d603aa7248f0cff056e1740880f821348d38630c6657f185efa1c07041115c76fe520a54fd6bdb5dd1474fa4ed040b1f4da81b5aeb8af5aa861
SSDEEP

12288:+BFeGGzb2OMLfQBpwKiOb1am8D0sh4PaG/:es1bksBpPvbEmO6PaG/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1172	1184	WerFault.exe	22

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 1172	1184	51bd237aa0b029f6c856804522ae868cf9bdce1fd50827887321ba22d4bc293a.exe	26
PID 1184 wrote to memory of 1172	1184	51bd237aa0b029f6c856804522ae868cf9bdce1fd50827887321ba22d4bc293a.exe	26
PID 1184 wrote to memory of 1172	1184	51bd237aa0b029f6c856804522ae868cf9bdce1fd50827887321ba22d4bc293a.exe	26
PID 1184 wrote to memory of 1172	1184	51bd237aa0b029f6c856804522ae868cf9bdce1fd50827887321ba22d4bc293a.exe	26

C:\Users\Admin\AppData\Local\Temp\51bd237aa0b029f6c856804522ae868cf9bdce1fd50827887321ba22d4bc293a.exe
"C:\Users\Admin\AppData\Local\Temp\51bd237aa0b029f6c856804522ae868cf9bdce1fd50827887321ba22d4bc293a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 152
  2⤵
  - Program crash
  PID:1172

memory/1184-54-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download
memory/1184-55-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download