52278b6400d8469deafb22019acf8b3075328abaf29848d8174fcc269766572d

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 04:57

Target

52278b6400d8469deafb22019acf8b3075328abaf29848d8174fcc269766572d.exe
Size

187KB
MD5

126232efd30636d2d66c7f983062535e
SHA1

4fe06929e8956fdcd62e553e8d3780356ce6b07f
SHA256

52278b6400d8469deafb22019acf8b3075328abaf29848d8174fcc269766572d
SHA512

b271ab4f8c0de207a9678a9f1a1e210fa1e7268ab2ef38518d8e17b665238e38cb3ba15aa12ce359e6dddeb04da2f7babb7e3318502abe62e8358122e445d35d
SSDEEP

3072:UYNQKPWDyDRefVJltZrpRl1P3RfgPsI59h/dxP1MC7ji:VNSDyDRO1thpH6sI7h/DPr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1648	1708	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1648	1708	52278b6400d8469deafb22019acf8b3075328abaf29848d8174fcc269766572d.exe	27
PID 1708 wrote to memory of 1648	1708	52278b6400d8469deafb22019acf8b3075328abaf29848d8174fcc269766572d.exe	27
PID 1708 wrote to memory of 1648	1708	52278b6400d8469deafb22019acf8b3075328abaf29848d8174fcc269766572d.exe	27
PID 1708 wrote to memory of 1648	1708	52278b6400d8469deafb22019acf8b3075328abaf29848d8174fcc269766572d.exe	27

C:\Users\Admin\AppData\Local\Temp\52278b6400d8469deafb22019acf8b3075328abaf29848d8174fcc269766572d.exe
"C:\Users\Admin\AppData\Local\Temp\52278b6400d8469deafb22019acf8b3075328abaf29848d8174fcc269766572d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 160
  2⤵
  - Program crash
  PID:1648

memory/1708-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1708-56-0x0000000001000000-0x000000000102A000-memory.dmp

Filesize
168KB

Download