0768b54c7d5a95817ae0bd49cb18540026372d0d2139b18c0440b327800e60c6

Analysis

max time kernel
34s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-10-2022 05:59

Target

0768b54c7d5a95817ae0bd49cb18540026372d0d2139b18c0440b327800e60c6.exe
Size

740KB
MD5

4780248507c0840cf7cf7706f8d41900
SHA1

e6167e0e369ce8ab128129311a6f91107b76465a
SHA256

0768b54c7d5a95817ae0bd49cb18540026372d0d2139b18c0440b327800e60c6
SHA512

bb68eb0369f6e1ded21b2bfb08e01f9d4a5ccf395853b870e52e739eb4747a7e96bceb2d3df2fd86d2bc7baddc73688f171e89d43408d18a61f59daede94ab3f
SSDEEP

6144:Hpqoa8aLiC/2OLSAN7gNVpNleQUohBfGPOtQciXeL/XYq:HpqiC/2OGAtkCP4cej

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1964	1364	WerFault.exe	9

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 1964	1364	0768b54c7d5a95817ae0bd49cb18540026372d0d2139b18c0440b327800e60c6.exe	28
PID 1364 wrote to memory of 1964	1364	0768b54c7d5a95817ae0bd49cb18540026372d0d2139b18c0440b327800e60c6.exe	28
PID 1364 wrote to memory of 1964	1364	0768b54c7d5a95817ae0bd49cb18540026372d0d2139b18c0440b327800e60c6.exe	28
PID 1364 wrote to memory of 1964	1364	0768b54c7d5a95817ae0bd49cb18540026372d0d2139b18c0440b327800e60c6.exe	28

C:\Users\Admin\AppData\Local\Temp\0768b54c7d5a95817ae0bd49cb18540026372d0d2139b18c0440b327800e60c6.exe
"C:\Users\Admin\AppData\Local\Temp\0768b54c7d5a95817ae0bd49cb18540026372d0d2139b18c0440b327800e60c6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 36
  2⤵
  - Program crash
  PID:1964

memory/1364-54-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download