897df637ad171021c5f16dc11da3915ed0d0d2a376637752842106c456a73720

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 06:35

Target

897df637ad171021c5f16dc11da3915ed0d0d2a376637752842106c456a73720.exe
Size

45KB
MD5

2904e0a5d6c52d5370ebc76ef49b78db
SHA1

5d748ed5fa8643f859cf52d19a0637f1c87d9c42
SHA256

897df637ad171021c5f16dc11da3915ed0d0d2a376637752842106c456a73720
SHA512

02569b4d67e577ccc8dd7397fab2a1f0838f181d68ac88b59d659c9057555a74f8328e33ee4f1e92f8f2b431e8f893b92b433064fdd1e20e459656d506936972
SSDEEP

384:bP8Xwia9q4IAoliIyoCoXnRKbwUoNPp/5IfAuWhYKEnbcv4w4YJLWIeTbNi:piaw4IKoCLEUoNPN53zhYxbcvpLsbNi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1928	1736	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1928	1736	897df637ad171021c5f16dc11da3915ed0d0d2a376637752842106c456a73720.exe	29
PID 1736 wrote to memory of 1928	1736	897df637ad171021c5f16dc11da3915ed0d0d2a376637752842106c456a73720.exe	29
PID 1736 wrote to memory of 1928	1736	897df637ad171021c5f16dc11da3915ed0d0d2a376637752842106c456a73720.exe	29
PID 1736 wrote to memory of 1928	1736	897df637ad171021c5f16dc11da3915ed0d0d2a376637752842106c456a73720.exe	29

C:\Users\Admin\AppData\Local\Temp\897df637ad171021c5f16dc11da3915ed0d0d2a376637752842106c456a73720.exe
"C:\Users\Admin\AppData\Local\Temp\897df637ad171021c5f16dc11da3915ed0d0d2a376637752842106c456a73720.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 72
  2⤵
  - Program crash
  PID:1928

memory/1736-54-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download