28f73f9a2cbc659027c2959de195e8e9265b72db4a41dff7f826d19749291ef9

Analysis

max time kernel
18s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 13:58

Target

28f73f9a2cbc659027c2959de195e8e9265b72db4a41dff7f826d19749291ef9.exe
Size

304KB
MD5

65dbc5d3cae583553f41423df33644a0
SHA1

5721625281f3bf8a7bc4d22f434cc092f5ac41b8
SHA256

28f73f9a2cbc659027c2959de195e8e9265b72db4a41dff7f826d19749291ef9
SHA512

5e6114152d0847939ada12fc562de9c005aea6cc6afc9591ab3f0398c543c4f7e16959ffec4c2387956cfce83fba0586cb5bccb159b2c655e6fd17eeba6ae01f
SSDEEP

3072:AnnAQVG/LytaKItS/fiLKS+f5Aq7isx/8qVaRlWmqsg9rkDQxvL8KcOYV:8OTeHI8HiL7+f5/x/YP89rzxC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
304	1508	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 304	1508	28f73f9a2cbc659027c2959de195e8e9265b72db4a41dff7f826d19749291ef9.exe	27
PID 1508 wrote to memory of 304	1508	28f73f9a2cbc659027c2959de195e8e9265b72db4a41dff7f826d19749291ef9.exe	27
PID 1508 wrote to memory of 304	1508	28f73f9a2cbc659027c2959de195e8e9265b72db4a41dff7f826d19749291ef9.exe	27
PID 1508 wrote to memory of 304	1508	28f73f9a2cbc659027c2959de195e8e9265b72db4a41dff7f826d19749291ef9.exe	27

C:\Users\Admin\AppData\Local\Temp\28f73f9a2cbc659027c2959de195e8e9265b72db4a41dff7f826d19749291ef9.exe
"C:\Users\Admin\AppData\Local\Temp\28f73f9a2cbc659027c2959de195e8e9265b72db4a41dff7f826d19749291ef9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 176
  2⤵
  - Program crash
  PID:304

memory/1508-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1508-56-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download