12e630214f06d5dd18074fbbaf76cf7c4ffbee9f3ae084c10686df014dc08c3e

Analysis

max time kernel
24s
max time network
89s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 05:34

Target

12e630214f06d5dd18074fbbaf76cf7c4ffbee9f3ae084c10686df014dc08c3e.exe
Size

108KB
MD5

4f2692cd70011fe6597ac4205b6ec520
SHA1

5f7ee7c3ecccf519ba1557500dc7cefaf3acec86
SHA256

12e630214f06d5dd18074fbbaf76cf7c4ffbee9f3ae084c10686df014dc08c3e
SHA512

2f8d814aa19fd3e5e1a0a55f726b736d136c85f384bcd3ac7ab467a9f0ecdeab86eac3d430173c77ba87a659418c8c7d843f7404f461f43540d142534d33124c
SSDEEP

1536:IzcwoH25NqucYAYl+H9SDzU5zjM7ODbzH25azAD8GXN+I7fJ+aCl1fey:IzKH25Nqol+HGuzWAQzoI7h+aS1Gy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1668	1044	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1668	1044	12e630214f06d5dd18074fbbaf76cf7c4ffbee9f3ae084c10686df014dc08c3e.exe	27
PID 1044 wrote to memory of 1668	1044	12e630214f06d5dd18074fbbaf76cf7c4ffbee9f3ae084c10686df014dc08c3e.exe	27
PID 1044 wrote to memory of 1668	1044	12e630214f06d5dd18074fbbaf76cf7c4ffbee9f3ae084c10686df014dc08c3e.exe	27
PID 1044 wrote to memory of 1668	1044	12e630214f06d5dd18074fbbaf76cf7c4ffbee9f3ae084c10686df014dc08c3e.exe	27

C:\Users\Admin\AppData\Local\Temp\12e630214f06d5dd18074fbbaf76cf7c4ffbee9f3ae084c10686df014dc08c3e.exe
"C:\Users\Admin\AppData\Local\Temp\12e630214f06d5dd18074fbbaf76cf7c4ffbee9f3ae084c10686df014dc08c3e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 120
  2⤵
  - Program crash
  PID:1668

memory/1044-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1044-56-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download