89e58ff2586773e9cdf99122848b2277ed736b0641b3ff94353842876aa5bfec

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 04:07

Target

89e58ff2586773e9cdf99122848b2277ed736b0641b3ff94353842876aa5bfec.exe
Size

160KB
MD5

0849b6e870498ecc8933e20a2c92a57c
SHA1

b6748e84652245ba5d81a02326fe7a5ce0b2f004
SHA256

89e58ff2586773e9cdf99122848b2277ed736b0641b3ff94353842876aa5bfec
SHA512

f5d890659220fe16868488a2cc1e3ad3c98b2738e1dd2ebe90e2dae5e677fccccf61fb8ca31dbe9ac317eb0b7d8c4b397d2cb0d25a1be07b149b3701555ae37d
SSDEEP

3072:bWLkZ9LPNijTksZ3+2hJFUWzP1DYYNSm2dNZbpAzdO5J:aLkZ9LPYfhZfJFpNDgDAzdQJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	1648	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2028	1648	89e58ff2586773e9cdf99122848b2277ed736b0641b3ff94353842876aa5bfec.exe	28
PID 1648 wrote to memory of 2028	1648	89e58ff2586773e9cdf99122848b2277ed736b0641b3ff94353842876aa5bfec.exe	28
PID 1648 wrote to memory of 2028	1648	89e58ff2586773e9cdf99122848b2277ed736b0641b3ff94353842876aa5bfec.exe	28
PID 1648 wrote to memory of 2028	1648	89e58ff2586773e9cdf99122848b2277ed736b0641b3ff94353842876aa5bfec.exe	28

C:\Users\Admin\AppData\Local\Temp\89e58ff2586773e9cdf99122848b2277ed736b0641b3ff94353842876aa5bfec.exe
"C:\Users\Admin\AppData\Local\Temp\89e58ff2586773e9cdf99122848b2277ed736b0641b3ff94353842876aa5bfec.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 152
  2⤵
  - Program crash
  PID:2028

memory/1648-54-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/1648-56-0x0000000000A80000-0x0000000000AAC000-memory.dmp

Filesize
176KB

Download
memory/2028-55-0x0000000000000000-mapping.dmp

Download