12206e0b5f348d6bc0fccb14a2f2ccda023e4aef2076d99194fba7ef2cc6665e

Analysis

max time kernel
44s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 12:48

Target

12206e0b5f348d6bc0fccb14a2f2ccda023e4aef2076d99194fba7ef2cc6665e.exe
Size

64KB
MD5

62fd021853d1de9969dbf86a1b45e3e9
SHA1

9c2783a4e7193a74d2f7627a4bc577052348ebd3
SHA256

12206e0b5f348d6bc0fccb14a2f2ccda023e4aef2076d99194fba7ef2cc6665e
SHA512

2c335eec2c07982beb4c1eea5b762b797bc71d5d4c53a3b7cce2a40ea0a183269e148660aa6a71fd64e729605322eaf3e97789d0b37a6f6c55ac98a256f24b20
SSDEEP

1536:8zBMynIVNXBdcKZh/WAQ/W9pgLzFKZmm42eQdIC4A0pqp6Ud3uU9kUZp:8+yn0t3cKZhTQ/2gLzw7pf0C/tuy9X

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1252	1760	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1252	1760	12206e0b5f348d6bc0fccb14a2f2ccda023e4aef2076d99194fba7ef2cc6665e.exe	27
PID 1760 wrote to memory of 1252	1760	12206e0b5f348d6bc0fccb14a2f2ccda023e4aef2076d99194fba7ef2cc6665e.exe	27
PID 1760 wrote to memory of 1252	1760	12206e0b5f348d6bc0fccb14a2f2ccda023e4aef2076d99194fba7ef2cc6665e.exe	27
PID 1760 wrote to memory of 1252	1760	12206e0b5f348d6bc0fccb14a2f2ccda023e4aef2076d99194fba7ef2cc6665e.exe	27

C:\Users\Admin\AppData\Local\Temp\12206e0b5f348d6bc0fccb14a2f2ccda023e4aef2076d99194fba7ef2cc6665e.exe
"C:\Users\Admin\AppData\Local\Temp\12206e0b5f348d6bc0fccb14a2f2ccda023e4aef2076d99194fba7ef2cc6665e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 36
  2⤵
  - Program crash
  PID:1252

memory/1760-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download