17bf8fb925b4396c130124bc95a41bcf4b15edbca1aaebfe966cacad7a734083

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 01:33

Target

17bf8fb925b4396c130124bc95a41bcf4b15edbca1aaebfe966cacad7a734083.exe
Size

188KB
MD5

6dfd09325a78f61cb1e93f66e9e406c6
SHA1

b5389d061721d99f42b1c59538b65583e5284a87
SHA256

17bf8fb925b4396c130124bc95a41bcf4b15edbca1aaebfe966cacad7a734083
SHA512

7403fd2791e53e9d3701a6fd7ca90f60dc559c0dc53e6385e22cf5eabbcc36c9a599cc7454415dc60dd90d643d9dafb86b0cb342dd24e83266c3d0a9047d1397
SSDEEP

3072:0OwZ2QNI3VGVilUVTz764/9xjEEUQqbZuwl5RGHngqovqW:0yVGgmx9tjUpZuwlrGHgqoR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
828	1324	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 828	1324	17bf8fb925b4396c130124bc95a41bcf4b15edbca1aaebfe966cacad7a734083.exe	27
PID 1324 wrote to memory of 828	1324	17bf8fb925b4396c130124bc95a41bcf4b15edbca1aaebfe966cacad7a734083.exe	27
PID 1324 wrote to memory of 828	1324	17bf8fb925b4396c130124bc95a41bcf4b15edbca1aaebfe966cacad7a734083.exe	27
PID 1324 wrote to memory of 828	1324	17bf8fb925b4396c130124bc95a41bcf4b15edbca1aaebfe966cacad7a734083.exe	27

C:\Users\Admin\AppData\Local\Temp\17bf8fb925b4396c130124bc95a41bcf4b15edbca1aaebfe966cacad7a734083.exe
"C:\Users\Admin\AppData\Local\Temp\17bf8fb925b4396c130124bc95a41bcf4b15edbca1aaebfe966cacad7a734083.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 168
  2⤵
  - Program crash
  PID:828

memory/1324-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download