2190f9f0340290e495f25601f25ed43e4db22c97629e1924a3a9d2d4a96de664

Analysis

max time kernel
5s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 04:25

Target

2190f9f0340290e495f25601f25ed43e4db22c97629e1924a3a9d2d4a96de664.exe
Size

99KB
MD5

615a6bbaea9185c0baab7f5d5075f121
SHA1

d6ffd99e613676a7df2821e9c651138202d527f8
SHA256

2190f9f0340290e495f25601f25ed43e4db22c97629e1924a3a9d2d4a96de664
SHA512

b39844746e47e6cd205e0e1d0156362ebc2464653f7a6a6ef8100de0cad5f4dcddee8d41df7d8cbfc9db608a27ce18f312012896720acc2d2309e3f80123c677
SSDEEP

1536:cu93m8yPTdtTGnKOM2z40IG3aSQ/vcUdcYOFQuIyfV9jIB0GAGexyT8BcIs8fTHL:V9rZnbMu4VyaSyvbdgVNIBhAGMNcu4I5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
1928	1852	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1928	1852	2190f9f0340290e495f25601f25ed43e4db22c97629e1924a3a9d2d4a96de664.exe	16
PID 1852 wrote to memory of 1928	1852	2190f9f0340290e495f25601f25ed43e4db22c97629e1924a3a9d2d4a96de664.exe	16
PID 1852 wrote to memory of 1928	1852	2190f9f0340290e495f25601f25ed43e4db22c97629e1924a3a9d2d4a96de664.exe	16
PID 1852 wrote to memory of 1928	1852	2190f9f0340290e495f25601f25ed43e4db22c97629e1924a3a9d2d4a96de664.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 88
1⤵
- Program crash
PID:1928

C:\Users\Admin\AppData\Local\Temp\2190f9f0340290e495f25601f25ed43e4db22c97629e1924a3a9d2d4a96de664.exe
"C:\Users\Admin\AppData\Local\Temp\2190f9f0340290e495f25601f25ed43e4db22c97629e1924a3a9d2d4a96de664.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1852

memory/1852-55-0x0000000013140000-0x000000001318B000-memory.dmp

Filesize
300KB

Download