22dbbe6cf64abdba1d9225e86fa7e455009158c24d4056834940ebb5b707db21

Analysis

max time kernel
43s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 18:31

Target

22dbbe6cf64abdba1d9225e86fa7e455009158c24d4056834940ebb5b707db21.exe
Size

3.4MB
MD5

69afb43e57651fb4fa22d1578d2284e1
SHA1

c1cf2dead7ab00bacdd17f7e819ed853bfc71204
SHA256

22dbbe6cf64abdba1d9225e86fa7e455009158c24d4056834940ebb5b707db21
SHA512

df0fc6d7b7803a3127f9845727219203457aff1283478db1c3bbfa7b577656e3d48615d8c13ab1ab4079465af62b9b227f993b356a4a7ee17d40c5dc67f255ae
SSDEEP

49152:Ta1ISQus8/2Ge/5mMk1HvWpcn2cVyCDxl4KZKWCbquSVex1yrZOZ:G1ISQusLGKmMaHgcnUgxPKWCbMs1Go

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
972	1368	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 972	1368	22dbbe6cf64abdba1d9225e86fa7e455009158c24d4056834940ebb5b707db21.exe	27
PID 1368 wrote to memory of 972	1368	22dbbe6cf64abdba1d9225e86fa7e455009158c24d4056834940ebb5b707db21.exe	27
PID 1368 wrote to memory of 972	1368	22dbbe6cf64abdba1d9225e86fa7e455009158c24d4056834940ebb5b707db21.exe	27
PID 1368 wrote to memory of 972	1368	22dbbe6cf64abdba1d9225e86fa7e455009158c24d4056834940ebb5b707db21.exe	27

C:\Users\Admin\AppData\Local\Temp\22dbbe6cf64abdba1d9225e86fa7e455009158c24d4056834940ebb5b707db21.exe
"C:\Users\Admin\AppData\Local\Temp\22dbbe6cf64abdba1d9225e86fa7e455009158c24d4056834940ebb5b707db21.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 228
  2⤵
  - Program crash
  PID:972

memory/972-55-0x0000000000000000-mapping.dmp

Download
memory/1368-54-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1368-56-0x0000000001000000-0x000000000137A000-memory.dmp

Filesize
3.5MB

Download