64d68fd731e979b3a12a60ef3893e6c207f14a0b2dbf6b758b3dd26c581e0983

Analysis

max time kernel
24s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 07:48

Target

64d68fd731e979b3a12a60ef3893e6c207f14a0b2dbf6b758b3dd26c581e0983.exe
Size

64KB
MD5

4a597ed15e5817f03fe4be2d4e302dd4
SHA1

a0f209619dc6078c661ea70139d34191e0b70b94
SHA256

64d68fd731e979b3a12a60ef3893e6c207f14a0b2dbf6b758b3dd26c581e0983
SHA512

f8a6dea0db8383b0ea05cd9a6a1e869ba664f2e7975711e4c9626103f3453914815486362cd8485c531b92b5a33f6bb204950c817d2c3272c76ca9e22abb896d
SSDEEP

1536:LKZiivgFkwb9nG3mlCaHLWX1TDZL5sjGZ6Wj7TkWsq7ZzBFLWp+g:wvcTZltLWX1TDVCyZ6WXwWfRc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1636	908	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 1636	908	64d68fd731e979b3a12a60ef3893e6c207f14a0b2dbf6b758b3dd26c581e0983.exe	27
PID 908 wrote to memory of 1636	908	64d68fd731e979b3a12a60ef3893e6c207f14a0b2dbf6b758b3dd26c581e0983.exe	27
PID 908 wrote to memory of 1636	908	64d68fd731e979b3a12a60ef3893e6c207f14a0b2dbf6b758b3dd26c581e0983.exe	27
PID 908 wrote to memory of 1636	908	64d68fd731e979b3a12a60ef3893e6c207f14a0b2dbf6b758b3dd26c581e0983.exe	27

C:\Users\Admin\AppData\Local\Temp\64d68fd731e979b3a12a60ef3893e6c207f14a0b2dbf6b758b3dd26c581e0983.exe
"C:\Users\Admin\AppData\Local\Temp\64d68fd731e979b3a12a60ef3893e6c207f14a0b2dbf6b758b3dd26c581e0983.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 36
  2⤵
  - Program crash
  PID:1636

memory/908-55-0x0000000000330000-0x0000000000358000-memory.dmp

Filesize
160KB

Download