29ff7f2dc5e08679845d5a4e1b848c121b80cdad8e4bd6a1fcd05cda94ffe465

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 18:31

Target

29ff7f2dc5e08679845d5a4e1b848c121b80cdad8e4bd6a1fcd05cda94ffe465.exe
Size

164KB
MD5

2f2f7053df2ca26864721f03caef0980
SHA1

7e678fd598286fd9043be72ad261078b7f4e8db0
SHA256

29ff7f2dc5e08679845d5a4e1b848c121b80cdad8e4bd6a1fcd05cda94ffe465
SHA512

260729378ea715a9e755827f6bdb030b0bd7c55767c0de1dd0b9b5b95ee737fe226a0762a13ad2d38a4a90a593f7efa7c969c5c020718af9b4223069d0b88812
SSDEEP

3072:dNQKPWDyUI0iJltZrpRXyy4mcQkmqJtNkIkQJN++2CYpHnOE:dNSDyUItthp9bcQkFki++

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1380	328	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 328 wrote to memory of 1380	328	29ff7f2dc5e08679845d5a4e1b848c121b80cdad8e4bd6a1fcd05cda94ffe465.exe	27
PID 328 wrote to memory of 1380	328	29ff7f2dc5e08679845d5a4e1b848c121b80cdad8e4bd6a1fcd05cda94ffe465.exe	27
PID 328 wrote to memory of 1380	328	29ff7f2dc5e08679845d5a4e1b848c121b80cdad8e4bd6a1fcd05cda94ffe465.exe	27
PID 328 wrote to memory of 1380	328	29ff7f2dc5e08679845d5a4e1b848c121b80cdad8e4bd6a1fcd05cda94ffe465.exe	27

C:\Users\Admin\AppData\Local\Temp\29ff7f2dc5e08679845d5a4e1b848c121b80cdad8e4bd6a1fcd05cda94ffe465.exe
"C:\Users\Admin\AppData\Local\Temp\29ff7f2dc5e08679845d5a4e1b848c121b80cdad8e4bd6a1fcd05cda94ffe465.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 328 -s 160
  2⤵
  - Program crash
  PID:1380

memory/328-54-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/328-55-0x0000000001000000-0x0000000001025000-memory.dmp

Filesize
148KB

Download