34a75ea6ac45843f5c565d4d6fbbbe6629459a5951fa15e6d86efb1829abb69b

Analysis

max time kernel
37s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 21:47

Target

34a75ea6ac45843f5c565d4d6fbbbe6629459a5951fa15e6d86efb1829abb69b.exe
Size

135KB
MD5

7add85329e6e3dc98748b832673f6de6
SHA1

da12c05321ba2bb926d673f1203b6b6b5b7f7944
SHA256

34a75ea6ac45843f5c565d4d6fbbbe6629459a5951fa15e6d86efb1829abb69b
SHA512

3d299900930c66462589cd4b073b72a0ba8b9e7275c07809d277eadc90284f334d6b3fc99ddd34d70a6ec54bea2478adafebe954150cd312199a1897a492ed5f
SSDEEP

3072:EfR+zcucphwKmloYg5Jr5tUuqZSthw+YEPsb1f52jVKxVoJk95iIu:CR+YH9D5JJ8Sthwacf52ZK8Q5iIu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1856	1492	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1856	1492	34a75ea6ac45843f5c565d4d6fbbbe6629459a5951fa15e6d86efb1829abb69b.exe	26
PID 1492 wrote to memory of 1856	1492	34a75ea6ac45843f5c565d4d6fbbbe6629459a5951fa15e6d86efb1829abb69b.exe	26
PID 1492 wrote to memory of 1856	1492	34a75ea6ac45843f5c565d4d6fbbbe6629459a5951fa15e6d86efb1829abb69b.exe	26
PID 1492 wrote to memory of 1856	1492	34a75ea6ac45843f5c565d4d6fbbbe6629459a5951fa15e6d86efb1829abb69b.exe	26

C:\Users\Admin\AppData\Local\Temp\34a75ea6ac45843f5c565d4d6fbbbe6629459a5951fa15e6d86efb1829abb69b.exe
"C:\Users\Admin\AppData\Local\Temp\34a75ea6ac45843f5c565d4d6fbbbe6629459a5951fa15e6d86efb1829abb69b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 48
  2⤵
  - Program crash
  PID:1856

memory/1492-54-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download