3625ec3eba014de1a0672149f2a793c605bd5e348573b2cb3d4a91bfd4551e1e

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 08:30

Target

1400-79-0x0000000000400000-0x0000000000417000-memory.exe
Size

92KB
MD5

ee772f8a61afd0e0f0c73e978e2ac369
SHA1

4595950f2c00d46169bd3453e0faf543195aec7e
SHA256

3625ec3eba014de1a0672149f2a793c605bd5e348573b2cb3d4a91bfd4551e1e
SHA512

237bad81a46ad2030799e59e5b0c7ef803f11e502bfcbdbbbf00fca96b7cf5b072cf981b253735526fbdc143018965e031d4af0a0e4605e85c9fa06e4f7eecd4
SSDEEP

1536:4hhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP:ehzYTGWVvJ8f2v1TbPzuMsIFSHNThy+x

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1172	1184	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 1172	1184	1400-79-0x0000000000400000-0x0000000000417000-memory.exe	26
PID 1184 wrote to memory of 1172	1184	1400-79-0x0000000000400000-0x0000000000417000-memory.exe	26
PID 1184 wrote to memory of 1172	1184	1400-79-0x0000000000400000-0x0000000000417000-memory.exe	26
PID 1184 wrote to memory of 1172	1184	1400-79-0x0000000000400000-0x0000000000417000-memory.exe	26

C:\Users\Admin\AppData\Local\Temp\1400-79-0x0000000000400000-0x0000000000417000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1400-79-0x0000000000400000-0x0000000000417000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 172
  2⤵
  - Program crash
  PID:1172

memory/1184-54-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download