90caf7a4b0fef0afff3eeadfc76a49026b33037689b7ea0e336cd3d05d3f40c4

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 02:19

Target

90caf7a4b0fef0afff3eeadfc76a49026b33037689b7ea0e336cd3d05d3f40c4.exe
Size

103KB
MD5

50193f13a273c8f98e46f05af42b0d5a
SHA1

3113c79b0eb07b9f4a854c24379550cc52e962ae
SHA256

90caf7a4b0fef0afff3eeadfc76a49026b33037689b7ea0e336cd3d05d3f40c4
SHA512

44ad4aed235c4984def144073c8283e048fbc79b5cf8fc6dc5bf8d46719389602ea3a11b797742e33431d7ec6d813aba2fe5127922b08ee19ddd25fc88206bf5
SSDEEP

1536:qOBjbUuFowmZSZCBKFUCj+kmKFUCj+kr8rDNKFUCj+k:pBj4a5CwFUCDRFUCDwrIFUCD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1276	1340	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1276	1340	90caf7a4b0fef0afff3eeadfc76a49026b33037689b7ea0e336cd3d05d3f40c4.exe	27
PID 1340 wrote to memory of 1276	1340	90caf7a4b0fef0afff3eeadfc76a49026b33037689b7ea0e336cd3d05d3f40c4.exe	27
PID 1340 wrote to memory of 1276	1340	90caf7a4b0fef0afff3eeadfc76a49026b33037689b7ea0e336cd3d05d3f40c4.exe	27
PID 1340 wrote to memory of 1276	1340	90caf7a4b0fef0afff3eeadfc76a49026b33037689b7ea0e336cd3d05d3f40c4.exe	27

C:\Users\Admin\AppData\Local\Temp\90caf7a4b0fef0afff3eeadfc76a49026b33037689b7ea0e336cd3d05d3f40c4.exe
"C:\Users\Admin\AppData\Local\Temp\90caf7a4b0fef0afff3eeadfc76a49026b33037689b7ea0e336cd3d05d3f40c4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 36
  2⤵
  - Program crash
  PID:1276

memory/1340-55-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download