7399f0ddf6d43ebeb487323fe9606a40729426b94c6519a8eac5e1b0c7ba5b12

Analysis

max time kernel
39s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 17:54

Target

7399f0ddf6d43ebeb487323fe9606a40729426b94c6519a8eac5e1b0c7ba5b12.exe
Size

423KB
MD5

7735a69aabfc56673e94a970595a4700
SHA1

863b6f6ce869cc56adb6a1ccfb280098d31946f3
SHA256

7399f0ddf6d43ebeb487323fe9606a40729426b94c6519a8eac5e1b0c7ba5b12
SHA512

3386586787997711ee55224a2a799bded4315a23f5469ad90d78397ae20524ce91793b0d5db19356aafec806c040bbefd4a735d574aaa68b85d2dcbc7fbad02d
SSDEEP

6144:zAOZolG3OtitZFIJSI7XrenMtEDtMYwODkyPy4ygYxypQ2uUeXx7HACouXuAVqad:zAOes+tiwKnPDtzkz4yBy2/UgHwuj5Xt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1028	836	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1028	836	7399f0ddf6d43ebeb487323fe9606a40729426b94c6519a8eac5e1b0c7ba5b12.exe	27
PID 836 wrote to memory of 1028	836	7399f0ddf6d43ebeb487323fe9606a40729426b94c6519a8eac5e1b0c7ba5b12.exe	27
PID 836 wrote to memory of 1028	836	7399f0ddf6d43ebeb487323fe9606a40729426b94c6519a8eac5e1b0c7ba5b12.exe	27
PID 836 wrote to memory of 1028	836	7399f0ddf6d43ebeb487323fe9606a40729426b94c6519a8eac5e1b0c7ba5b12.exe	27

C:\Users\Admin\AppData\Local\Temp\7399f0ddf6d43ebeb487323fe9606a40729426b94c6519a8eac5e1b0c7ba5b12.exe
"C:\Users\Admin\AppData\Local\Temp\7399f0ddf6d43ebeb487323fe9606a40729426b94c6519a8eac5e1b0c7ba5b12.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 36
  2⤵
  - Program crash
  PID:1028

memory/836-54-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download