b700941a65ca54462c98f1623277b77f28ea74733ea393af4aa490ebf44cff66

Analysis

max time kernel
46s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 23:54

Target

b700941a65ca54462c98f1623277b77f28ea74733ea393af4aa490ebf44cff66.exe
Size

83KB
MD5

09a85ba0bcc184014463840ac88e49b0
SHA1

35f9187c5f8cb4a8586ed700de6e5dbb7b0927e2
SHA256

b700941a65ca54462c98f1623277b77f28ea74733ea393af4aa490ebf44cff66
SHA512

8078af488a2b61dd43976ff4974a35748cc10045f38bec7c846e901134133d51cc45b4dd11acfe8024a0af732164e3943ceb2569a806bf69268a2c731b8e632f
SSDEEP

1536:qONHnqtPGpPOlhJh5rcg+9FusZcTupOmBpjVrs2ryrd1vUQuqc3WMF:DnqtPOPchJhmnNZcTpmBHs2qMW6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	2012	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1992	2012	b700941a65ca54462c98f1623277b77f28ea74733ea393af4aa490ebf44cff66.exe	28
PID 2012 wrote to memory of 1992	2012	b700941a65ca54462c98f1623277b77f28ea74733ea393af4aa490ebf44cff66.exe	28
PID 2012 wrote to memory of 1992	2012	b700941a65ca54462c98f1623277b77f28ea74733ea393af4aa490ebf44cff66.exe	28
PID 2012 wrote to memory of 1992	2012	b700941a65ca54462c98f1623277b77f28ea74733ea393af4aa490ebf44cff66.exe	28

C:\Users\Admin\AppData\Local\Temp\b700941a65ca54462c98f1623277b77f28ea74733ea393af4aa490ebf44cff66.exe
"C:\Users\Admin\AppData\Local\Temp\b700941a65ca54462c98f1623277b77f28ea74733ea393af4aa490ebf44cff66.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 36
  2⤵
  - Program crash
  PID:1992

memory/2012-55-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download