afc21797d0919ed15cd5615627781375edd1262a8536f77a33d8a6ff515f191a

Analysis

max time kernel
38s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 11:38

Target

afc21797d0919ed15cd5615627781375edd1262a8536f77a33d8a6ff515f191a.exe
Size

478KB
MD5

7a4b821c449357649fc11530f544e930
SHA1

b00b42a774d37bb145d20379564b4dcf79dd6e83
SHA256

afc21797d0919ed15cd5615627781375edd1262a8536f77a33d8a6ff515f191a
SHA512

b82ebb5fbace2763d2d795de45dda63e4163fd2f49f7d79831fe46efe075cd1fc2daab5e9e4ad26e793dc963b3731064dd11bd069af3f1212b1e2157b55c48d9
SSDEEP

12288:7QZtQ5g4ni4nH/Abg8p9ycKoh+g70XdRKZHpNvCaQu4V:8ZkZnfTCycKoh+g70XdRKZHvvCZV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1552	956	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1552	956	afc21797d0919ed15cd5615627781375edd1262a8536f77a33d8a6ff515f191a.exe	27
PID 956 wrote to memory of 1552	956	afc21797d0919ed15cd5615627781375edd1262a8536f77a33d8a6ff515f191a.exe	27
PID 956 wrote to memory of 1552	956	afc21797d0919ed15cd5615627781375edd1262a8536f77a33d8a6ff515f191a.exe	27
PID 956 wrote to memory of 1552	956	afc21797d0919ed15cd5615627781375edd1262a8536f77a33d8a6ff515f191a.exe	27

C:\Users\Admin\AppData\Local\Temp\afc21797d0919ed15cd5615627781375edd1262a8536f77a33d8a6ff515f191a.exe
"C:\Users\Admin\AppData\Local\Temp\afc21797d0919ed15cd5615627781375edd1262a8536f77a33d8a6ff515f191a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 116
  2⤵
  - Program crash
  PID:1552

memory/956-54-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download
memory/956-56-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download