42f822220fd515ad9b853a4f962983970ad2df2244aeec392a35479483a09b52

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 20:09

Target

42f822220fd515ad9b853a4f962983970ad2df2244aeec392a35479483a09b52.exe
Size

83KB
MD5

006aa7abfa728deee7879e9702b43250
SHA1

f4a90d90cd59b7fea43264ad4e67721791717afb
SHA256

42f822220fd515ad9b853a4f962983970ad2df2244aeec392a35479483a09b52
SHA512

3714cedb49da25e482f30e04c76227d3f2acf620c3e26098aee26fbd76ee86f1e272063d480de16a62837fb2d3538fc4b403c4bebb2532fe2df19f59c7a26406
SSDEEP

1536:ZTXB+5p3Bi+HpM4tmJd7NeYRNgKJ+BCy9FIPwDBsxiGzlezKVCPNb24:ZTs3BxJNmJfeqgKJ+BCZPQqxtpuKkNf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
896	1964	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 896	1964	42f822220fd515ad9b853a4f962983970ad2df2244aeec392a35479483a09b52.exe	28
PID 1964 wrote to memory of 896	1964	42f822220fd515ad9b853a4f962983970ad2df2244aeec392a35479483a09b52.exe	28
PID 1964 wrote to memory of 896	1964	42f822220fd515ad9b853a4f962983970ad2df2244aeec392a35479483a09b52.exe	28
PID 1964 wrote to memory of 896	1964	42f822220fd515ad9b853a4f962983970ad2df2244aeec392a35479483a09b52.exe	28

C:\Users\Admin\AppData\Local\Temp\42f822220fd515ad9b853a4f962983970ad2df2244aeec392a35479483a09b52.exe
"C:\Users\Admin\AppData\Local\Temp\42f822220fd515ad9b853a4f962983970ad2df2244aeec392a35479483a09b52.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 164
  2⤵
  - Program crash
  PID:896

memory/1964-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1964-56-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download