f7321fe63a9a94cb1f05ec4fff1b62a0fc660a1be06bb7c3001873c7cbe305ce

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
12-10-2022 16:20

Target

f7321fe63a9a94cb1f05ec4fff1b62a0fc660a1be06bb7c3001873c7cbe305ce.exe
Size

89KB
MD5

6b59f804d9adef4877fb5a8946217a70
SHA1

c30e8c5978306d80a6bca91f803af7a3f7c9fec1
SHA256

f7321fe63a9a94cb1f05ec4fff1b62a0fc660a1be06bb7c3001873c7cbe305ce
SHA512

81f013fb630ab510d825effe15b09a6c6373efbd5b9cd5ad59fd7bca9ecf1ec8e6f339d326023027c674ae2993f5c09918ead0d1e5c5cf4bc4b7619c934f219b
SSDEEP

768:vzuendi2gWEycST6tFlJI3TvegRGFKPWcfd8MKOBbm0eX04iXpNCKueb:Ce4hHyc26l4nPWhMHBbm0eX04iXpN1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1188	1416	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1188	1416	f7321fe63a9a94cb1f05ec4fff1b62a0fc660a1be06bb7c3001873c7cbe305ce.exe	27
PID 1416 wrote to memory of 1188	1416	f7321fe63a9a94cb1f05ec4fff1b62a0fc660a1be06bb7c3001873c7cbe305ce.exe	27
PID 1416 wrote to memory of 1188	1416	f7321fe63a9a94cb1f05ec4fff1b62a0fc660a1be06bb7c3001873c7cbe305ce.exe	27
PID 1416 wrote to memory of 1188	1416	f7321fe63a9a94cb1f05ec4fff1b62a0fc660a1be06bb7c3001873c7cbe305ce.exe	27

C:\Users\Admin\AppData\Local\Temp\f7321fe63a9a94cb1f05ec4fff1b62a0fc660a1be06bb7c3001873c7cbe305ce.exe
"C:\Users\Admin\AppData\Local\Temp\f7321fe63a9a94cb1f05ec4fff1b62a0fc660a1be06bb7c3001873c7cbe305ce.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 136
  2⤵
  - Program crash
  PID:1188

memory/1416-54-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download