c7e3f4b709536c0fb8653ad23606416e7e5a07baafc811c3136b546c7b1828af

Analysis

max time kernel
18s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 19:12

Target

c7e3f4b709536c0fb8653ad23606416e7e5a07baafc811c3136b546c7b1828af.exe
Size

20KB
MD5

81ceb60360ba84f2f52bc75f1908a300
SHA1

a7db5ad98fbb08875ecdf053c5173082e0944e11
SHA256

c7e3f4b709536c0fb8653ad23606416e7e5a07baafc811c3136b546c7b1828af
SHA512

1b5e02fe15d752737312e4c80d19ced00c0740ed5be79c893ee0cc4ea42aca923622db1d8a5de8cdf33bf198b591e4f56b5d71dacebbdffb42d2b3ea13ea13ab
SSDEEP

12:eNGSGFcNz4sm9mruMFsjc+iRYQ/MOhXooXGo8eeeeeeeetSjgbgnar4KlgMQrOq0:eNGS8OrmEruMFspiRP9ZZjGNO7B

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1972	272	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 272 wrote to memory of 1972	272	c7e3f4b709536c0fb8653ad23606416e7e5a07baafc811c3136b546c7b1828af.exe	29
PID 272 wrote to memory of 1972	272	c7e3f4b709536c0fb8653ad23606416e7e5a07baafc811c3136b546c7b1828af.exe	29
PID 272 wrote to memory of 1972	272	c7e3f4b709536c0fb8653ad23606416e7e5a07baafc811c3136b546c7b1828af.exe	29
PID 272 wrote to memory of 1972	272	c7e3f4b709536c0fb8653ad23606416e7e5a07baafc811c3136b546c7b1828af.exe	29

C:\Users\Admin\AppData\Local\Temp\c7e3f4b709536c0fb8653ad23606416e7e5a07baafc811c3136b546c7b1828af.exe
"C:\Users\Admin\AppData\Local\Temp\c7e3f4b709536c0fb8653ad23606416e7e5a07baafc811c3136b546c7b1828af.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 272 -s 88
  2⤵
  - Program crash
  PID:1972

memory/272-55-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download