98e61f92b896804ffafb06e2b20503d63c48742e34e489db4eccc922011a9a2a

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-10-2022 05:12

Target

98e61f92b896804ffafb06e2b20503d63c48742e34e489db4eccc922011a9a2a.exe
Size

332KB
MD5

338cbfacd2d8b39af0ca9baed07ae079
SHA1

7498c118558edbcb2e1c170fcffab17ae812265e
SHA256

98e61f92b896804ffafb06e2b20503d63c48742e34e489db4eccc922011a9a2a
SHA512

618d14acca4014a93b3218eabf977d2c6ab64f43cbad946af3428140dcfa146f0b01059f268bd9e479505631d59ccf1677ce4b2681d5cf1d3fa517078c1af1b8
SSDEEP

6144:sWC/zY3GzYzLJfv/UhFxJsdoOsOi/Cg87W/Wm/0JsMDcPT+5WGFJaZOFpEZMmQ8y:st/2Jfv/ADH/MW/Wm7MDgTuaZxZMma

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
956	960	WerFault.exe	26

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 956	960	98e61f92b896804ffafb06e2b20503d63c48742e34e489db4eccc922011a9a2a.exe	27
PID 960 wrote to memory of 956	960	98e61f92b896804ffafb06e2b20503d63c48742e34e489db4eccc922011a9a2a.exe	27
PID 960 wrote to memory of 956	960	98e61f92b896804ffafb06e2b20503d63c48742e34e489db4eccc922011a9a2a.exe	27
PID 960 wrote to memory of 956	960	98e61f92b896804ffafb06e2b20503d63c48742e34e489db4eccc922011a9a2a.exe	27
PID 960 wrote to memory of 956	960	98e61f92b896804ffafb06e2b20503d63c48742e34e489db4eccc922011a9a2a.exe	27
PID 960 wrote to memory of 956	960	98e61f92b896804ffafb06e2b20503d63c48742e34e489db4eccc922011a9a2a.exe	27
PID 960 wrote to memory of 956	960	98e61f92b896804ffafb06e2b20503d63c48742e34e489db4eccc922011a9a2a.exe	27

C:\Users\Admin\AppData\Local\Temp\98e61f92b896804ffafb06e2b20503d63c48742e34e489db4eccc922011a9a2a.exe
"C:\Users\Admin\AppData\Local\Temp\98e61f92b896804ffafb06e2b20503d63c48742e34e489db4eccc922011a9a2a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 268
  2⤵
  - Program crash
  PID:956

memory/956-55-0x0000000000000000-mapping.dmp

Download
memory/960-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/960-56-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/960-57-0x0000000000240000-0x0000000000297000-memory.dmp

Filesize
348KB

Download