7a7f422ad744fb85cccfa918c3d7ba25a0e904d5bdf0a7f46cd14adc310764e9

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 04:33

Target

7a7f422ad744fb85cccfa918c3d7ba25a0e904d5bdf0a7f46cd14adc310764e9.exe
Size

390KB
MD5

6ee209a7dbc5cf0d54893d2891c7ff7b
SHA1

369773a1543d2f5e624c3f132d20b023f1e1357d
SHA256

7a7f422ad744fb85cccfa918c3d7ba25a0e904d5bdf0a7f46cd14adc310764e9
SHA512

5d5418376c1671669c445a2b43ace92ab0a415830bf7135b90ff8e00793d35e5f8d34febca37c0cc041d5e3597f187279e7f15682feb941956d2e64aa314de37
SSDEEP

6144:UVgi+YOo30Nx5RxV58qJVPYnDa8YNYFyQ028k9vQGNLmne/cvGqt5vp7b:UVT+toEVRDJtYnF1F62XbKlt5hH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
896	1812	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 896	1812	7a7f422ad744fb85cccfa918c3d7ba25a0e904d5bdf0a7f46cd14adc310764e9.exe	28
PID 1812 wrote to memory of 896	1812	7a7f422ad744fb85cccfa918c3d7ba25a0e904d5bdf0a7f46cd14adc310764e9.exe	28
PID 1812 wrote to memory of 896	1812	7a7f422ad744fb85cccfa918c3d7ba25a0e904d5bdf0a7f46cd14adc310764e9.exe	28
PID 1812 wrote to memory of 896	1812	7a7f422ad744fb85cccfa918c3d7ba25a0e904d5bdf0a7f46cd14adc310764e9.exe	28

C:\Users\Admin\AppData\Local\Temp\7a7f422ad744fb85cccfa918c3d7ba25a0e904d5bdf0a7f46cd14adc310764e9.exe
"C:\Users\Admin\AppData\Local\Temp\7a7f422ad744fb85cccfa918c3d7ba25a0e904d5bdf0a7f46cd14adc310764e9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 64
  2⤵
  - Program crash
  PID:896

memory/1812-55-0x0000000000960000-0x0000000000998000-memory.dmp

Filesize
224KB

Download