215b20c55db5c608f7cd9e103ffd0da4a9c7b95ed2bec6317001cbed49906a5b

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 04:38

Target

215b20c55db5c608f7cd9e103ffd0da4a9c7b95ed2bec6317001cbed49906a5b.exe
Size

859KB
MD5

667cb747a1e7ea9dac1febed40673630
SHA1

b06377010ba662fd092bc6b30bfabc9c7226070b
SHA256

215b20c55db5c608f7cd9e103ffd0da4a9c7b95ed2bec6317001cbed49906a5b
SHA512

6deb3a7958298829e13552953a952fb4ae5761608d080337b37295cc12481c6a0725719569af6542c554530402ab44fbe945b09cd57b2c5481f0fe5ec88c026e
SSDEEP

24576:yutFp4x/m7896LsoQbBneDTPBpFl+dD43t+ou:tVoeY9wLDTPADoe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	1672	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1696	1672	215b20c55db5c608f7cd9e103ffd0da4a9c7b95ed2bec6317001cbed49906a5b.exe	28
PID 1672 wrote to memory of 1696	1672	215b20c55db5c608f7cd9e103ffd0da4a9c7b95ed2bec6317001cbed49906a5b.exe	28
PID 1672 wrote to memory of 1696	1672	215b20c55db5c608f7cd9e103ffd0da4a9c7b95ed2bec6317001cbed49906a5b.exe	28
PID 1672 wrote to memory of 1696	1672	215b20c55db5c608f7cd9e103ffd0da4a9c7b95ed2bec6317001cbed49906a5b.exe	28

C:\Users\Admin\AppData\Local\Temp\215b20c55db5c608f7cd9e103ffd0da4a9c7b95ed2bec6317001cbed49906a5b.exe
"C:\Users\Admin\AppData\Local\Temp\215b20c55db5c608f7cd9e103ffd0da4a9c7b95ed2bec6317001cbed49906a5b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 192
  2⤵
  - Program crash
  PID:1696

memory/1672-54-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1672-56-0x0000000000110000-0x00000000001E4000-memory.dmp

Filesize
848KB

Download