c65d69e612522c6bedd133cfcec323b3b7076b506bc664143f24cd3f979de94a

Analysis

max time kernel
43s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 22:00

Target

c65d69e612522c6bedd133cfcec323b3b7076b506bc664143f24cd3f979de94a.exe
Size

189KB
MD5

6976277e1600cd91603714dbdfa92591
SHA1

732576046b049fd4a7093366894d3efd7fd33ab1
SHA256

c65d69e612522c6bedd133cfcec323b3b7076b506bc664143f24cd3f979de94a
SHA512

353717a09765e4dc49d4bb1d5c30b1d9b1df953a81dd009c047dce3085bd143ae6dbdf1309c801ab86f74e196f2fc9c1d88c7cb0381259d6218ebc86c34e8b54
SSDEEP

3072:FVm5jdZp1JeR07lfaytvSGRuo0vsxAJec6oMclbv7JLtRjAFxqlZUJtbMoIBZtko:FojdZp1JeR07lf7tvSfofI9RblAu3ct6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2044	1160	WerFault.exe	26

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 2044	1160	c65d69e612522c6bedd133cfcec323b3b7076b506bc664143f24cd3f979de94a.exe	27
PID 1160 wrote to memory of 2044	1160	c65d69e612522c6bedd133cfcec323b3b7076b506bc664143f24cd3f979de94a.exe	27
PID 1160 wrote to memory of 2044	1160	c65d69e612522c6bedd133cfcec323b3b7076b506bc664143f24cd3f979de94a.exe	27
PID 1160 wrote to memory of 2044	1160	c65d69e612522c6bedd133cfcec323b3b7076b506bc664143f24cd3f979de94a.exe	27
PID 1160 wrote to memory of 2044	1160	c65d69e612522c6bedd133cfcec323b3b7076b506bc664143f24cd3f979de94a.exe	27
PID 1160 wrote to memory of 2044	1160	c65d69e612522c6bedd133cfcec323b3b7076b506bc664143f24cd3f979de94a.exe	27
PID 1160 wrote to memory of 2044	1160	c65d69e612522c6bedd133cfcec323b3b7076b506bc664143f24cd3f979de94a.exe	27

C:\Users\Admin\AppData\Local\Temp\c65d69e612522c6bedd133cfcec323b3b7076b506bc664143f24cd3f979de94a.exe
"C:\Users\Admin\AppData\Local\Temp\c65d69e612522c6bedd133cfcec323b3b7076b506bc664143f24cd3f979de94a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 332
  2⤵
  - Program crash
  PID:2044

memory/1160-54-0x00000000762E1000-0x00000000762E3000-memory.dmp

Filesize
8KB

Download
memory/1160-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1160-57-0x0000000000240000-0x0000000000271000-memory.dmp

Filesize
196KB

Download
memory/1160-58-0x0000000000240000-0x0000000000271000-memory.dmp

Filesize
196KB

Download