6225007ccf6465da756f39ed0f2641d22b55582ed3404201818dfab13131418f

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
10-10-2022 23:51

Target

6225007ccf6465da756f39ed0f2641d22b55582ed3404201818dfab13131418f.exe
Size

284KB
MD5

7938bc75634c41108a453d57c6c2186a
SHA1

91bb3cf20f5f1df389eb28e6985a694b89bf38d1
SHA256

6225007ccf6465da756f39ed0f2641d22b55582ed3404201818dfab13131418f
SHA512

486920f110e90941a743ec21a9eb838a7391bc4f01aa01e551db49c40e3c8d6e455791f253e74cdabad876baa90f612ef428ebdc05155fe0954c68a1fb4ca963
SSDEEP

6144:+ewgP+k+vV9U/6qarjPlnjWXba6bChU3wBfVzDiNweo96Unh:+SP+7vVlqa3ljUbV0YwjXiN66Unh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1388	1048	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1388	1048	6225007ccf6465da756f39ed0f2641d22b55582ed3404201818dfab13131418f.exe	27
PID 1048 wrote to memory of 1388	1048	6225007ccf6465da756f39ed0f2641d22b55582ed3404201818dfab13131418f.exe	27
PID 1048 wrote to memory of 1388	1048	6225007ccf6465da756f39ed0f2641d22b55582ed3404201818dfab13131418f.exe	27
PID 1048 wrote to memory of 1388	1048	6225007ccf6465da756f39ed0f2641d22b55582ed3404201818dfab13131418f.exe	27

C:\Users\Admin\AppData\Local\Temp\6225007ccf6465da756f39ed0f2641d22b55582ed3404201818dfab13131418f.exe
"C:\Users\Admin\AppData\Local\Temp\6225007ccf6465da756f39ed0f2641d22b55582ed3404201818dfab13131418f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 172
  2⤵
  - Program crash
  PID:1388

memory/1048-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1048-56-0x00000000013B0000-0x00000000013CF000-memory.dmp

Filesize
124KB

Download