1b44140b02993641254f874ccc8de9e1ad6ff88e27315264cc02289ee05db9ca

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 12:44

Target

1b44140b02993641254f874ccc8de9e1ad6ff88e27315264cc02289ee05db9ca.exe
Size

353KB
MD5

5f2b97d66e8a98b6dd996ee1558c4140
SHA1

7f4b07ff9488b40d70340772541eaa49b5921be0
SHA256

1b44140b02993641254f874ccc8de9e1ad6ff88e27315264cc02289ee05db9ca
SHA512

0dc8047adafe091f90ca5cc4cc114b78b41eecd1912ffc93be1fb06914edd9da755ab5814c36f459aed4910bb5d1a6edde3707dbf2b2f9fae7072dbeac3a3317
SSDEEP

6144:InWWLYK/wguJpVopIM/eiG3cE9bAxsfW7qz1jC84PXJcKf:PWLYzjJ7oaz33O6euNC8+ZN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1944	1908	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1944	1908	1b44140b02993641254f874ccc8de9e1ad6ff88e27315264cc02289ee05db9ca.exe	28
PID 1908 wrote to memory of 1944	1908	1b44140b02993641254f874ccc8de9e1ad6ff88e27315264cc02289ee05db9ca.exe	28
PID 1908 wrote to memory of 1944	1908	1b44140b02993641254f874ccc8de9e1ad6ff88e27315264cc02289ee05db9ca.exe	28
PID 1908 wrote to memory of 1944	1908	1b44140b02993641254f874ccc8de9e1ad6ff88e27315264cc02289ee05db9ca.exe	28

C:\Users\Admin\AppData\Local\Temp\1b44140b02993641254f874ccc8de9e1ad6ff88e27315264cc02289ee05db9ca.exe
"C:\Users\Admin\AppData\Local\Temp\1b44140b02993641254f874ccc8de9e1ad6ff88e27315264cc02289ee05db9ca.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 36
  2⤵
  - Program crash
  PID:1944

memory/1908-55-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1944-54-0x0000000000000000-mapping.dmp

Download