2b05a81028414d635f51e8f1feea7e7d63ef68e54d0b58faafeaafbc1f578634

Analysis

max time kernel
38s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10/10/2022, 23:53

Target

2b05a81028414d635f51e8f1feea7e7d63ef68e54d0b58faafeaafbc1f578634.exe
Size

706KB
MD5

7977439f25f3f4e3f4fd1352331d18c0
SHA1

ad19f2dabbbf3a1e81afa41406d3a4f911adf27b
SHA256

2b05a81028414d635f51e8f1feea7e7d63ef68e54d0b58faafeaafbc1f578634
SHA512

5190ecf5882a9f47dadb4e3a2613f851ee1b9792d85f845f24bd32959d624de5927031afa76abf0c0249f0d225d8541c1b6bad2c9a7f3420e7da7b0e96dbaa45
SSDEEP

12288:YaER9YNXC3h/2yS8M12nAFQQMPGnkGTsQgz2yXTqSyez4eh:YbwdGVS8MFqPGBT5y+2J

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1968	1976	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1968	1976	2b05a81028414d635f51e8f1feea7e7d63ef68e54d0b58faafeaafbc1f578634.exe	26
PID 1976 wrote to memory of 1968	1976	2b05a81028414d635f51e8f1feea7e7d63ef68e54d0b58faafeaafbc1f578634.exe	26
PID 1976 wrote to memory of 1968	1976	2b05a81028414d635f51e8f1feea7e7d63ef68e54d0b58faafeaafbc1f578634.exe	26
PID 1976 wrote to memory of 1968	1976	2b05a81028414d635f51e8f1feea7e7d63ef68e54d0b58faafeaafbc1f578634.exe	26

C:\Users\Admin\AppData\Local\Temp\2b05a81028414d635f51e8f1feea7e7d63ef68e54d0b58faafeaafbc1f578634.exe
"C:\Users\Admin\AppData\Local\Temp\2b05a81028414d635f51e8f1feea7e7d63ef68e54d0b58faafeaafbc1f578634.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 156
  2⤵
  - Program crash
  PID:1968

memory/1976-54-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download
memory/1976-56-0x0000000000D50000-0x0000000000DDA000-memory.dmp

Filesize
552KB

Download