713abb7d21ee5758a312cb23828604ef30e0dbf45f54b5d2044207d6a4f8dc81

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 12:26

Target

713abb7d21ee5758a312cb23828604ef30e0dbf45f54b5d2044207d6a4f8dc81.exe
Size

622KB
MD5

91ae9fcce8f531a54daf88122a01de62
SHA1

54aa0789e2b015c694a444fa10497bf181709d1e
SHA256

713abb7d21ee5758a312cb23828604ef30e0dbf45f54b5d2044207d6a4f8dc81
SHA512

fd5fd9a62903290c6c4332c9066831824f7c126bbe777d92fbda4f871600ac51ca99a0136192c82a7c315ad9beb735efceabc1f8d8c11099d4aaec86257c63c2
SSDEEP

12288:hmMo2GraeffedpbtwfN6T205Sz7zctMJI38s:VoDaqWLuMT205SzktMid

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2032	1408	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 2032	1408	713abb7d21ee5758a312cb23828604ef30e0dbf45f54b5d2044207d6a4f8dc81.exe	27
PID 1408 wrote to memory of 2032	1408	713abb7d21ee5758a312cb23828604ef30e0dbf45f54b5d2044207d6a4f8dc81.exe	27
PID 1408 wrote to memory of 2032	1408	713abb7d21ee5758a312cb23828604ef30e0dbf45f54b5d2044207d6a4f8dc81.exe	27
PID 1408 wrote to memory of 2032	1408	713abb7d21ee5758a312cb23828604ef30e0dbf45f54b5d2044207d6a4f8dc81.exe	27

C:\Users\Admin\AppData\Local\Temp\713abb7d21ee5758a312cb23828604ef30e0dbf45f54b5d2044207d6a4f8dc81.exe
"C:\Users\Admin\AppData\Local\Temp\713abb7d21ee5758a312cb23828604ef30e0dbf45f54b5d2044207d6a4f8dc81.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 168
  2⤵
  - Program crash
  PID:2032

memory/1408-54-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/1408-56-0x0000000000F00000-0x00000000010EA000-memory.dmp

Filesize
1.9MB

Download