350d9f8537ea5a92eb2435e64114504c0d077f689a4364578ba3973b43159994

Analysis

max time kernel
14s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 17:23

Target

350d9f8537ea5a92eb2435e64114504c0d077f689a4364578ba3973b43159994.exe
Size

24KB
MD5

77956af4918742aaea93aeed8ff52538
SHA1

4b045f9ec66d050271fdb231ad8ef4785daf0bfc
SHA256

350d9f8537ea5a92eb2435e64114504c0d077f689a4364578ba3973b43159994
SHA512

63185871cc501ac68c2b85b14dc092f68064571199b907d05133f1ab17b63d66ad9f637c8794581827e33e7d4d5c7e003da98b79c9537d47f9aa27bfc888c01e
SSDEEP

384:QZfFak78ietIm35otzIQW29LgzePBxwRX++VqK6/6O1/ZuaPKOARS/bCPC:QZUk7uY82gaJaw+VqK6/6O1huaPKVSTj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1672	1836	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 1672	1836	350d9f8537ea5a92eb2435e64114504c0d077f689a4364578ba3973b43159994.exe	28
PID 1836 wrote to memory of 1672	1836	350d9f8537ea5a92eb2435e64114504c0d077f689a4364578ba3973b43159994.exe	28
PID 1836 wrote to memory of 1672	1836	350d9f8537ea5a92eb2435e64114504c0d077f689a4364578ba3973b43159994.exe	28
PID 1836 wrote to memory of 1672	1836	350d9f8537ea5a92eb2435e64114504c0d077f689a4364578ba3973b43159994.exe	28

C:\Users\Admin\AppData\Local\Temp\350d9f8537ea5a92eb2435e64114504c0d077f689a4364578ba3973b43159994.exe
"C:\Users\Admin\AppData\Local\Temp\350d9f8537ea5a92eb2435e64114504c0d077f689a4364578ba3973b43159994.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 36
  2⤵
  - Program crash
  PID:1672

memory/1836-55-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download