371848ffcd0f0a70828f077ef8bb3c91abc4caabc7ec8cc4f73139ab6cdbbc1d

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 20:20

Target

371848ffcd0f0a70828f077ef8bb3c91abc4caabc7ec8cc4f73139ab6cdbbc1d.exe
Size

76KB
MD5

8245ed107487127baf2130ee65c180b0
SHA1

a71203a3850a2cb6337dfdbfab403089ff6a2370
SHA256

371848ffcd0f0a70828f077ef8bb3c91abc4caabc7ec8cc4f73139ab6cdbbc1d
SHA512

5551b286d6fd7196d12b1504c37925d88726a773e7487605d4aae98b8456dee18642ea8f0c18ee9c91d9d3f51ef7c0b83364adbc98212c3f83fb45e2965352fe
SSDEEP

1536:Z6FfbSOPCx4Ehlz7poKK47RF0EI1YjHBnWrflgHYwqYpjVrs2ryrd1vUQuq6:ZsTPCLF9oKNtqcBnWrfleqYHs2qo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1772	1720	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1772	1720	371848ffcd0f0a70828f077ef8bb3c91abc4caabc7ec8cc4f73139ab6cdbbc1d.exe	26
PID 1720 wrote to memory of 1772	1720	371848ffcd0f0a70828f077ef8bb3c91abc4caabc7ec8cc4f73139ab6cdbbc1d.exe	26
PID 1720 wrote to memory of 1772	1720	371848ffcd0f0a70828f077ef8bb3c91abc4caabc7ec8cc4f73139ab6cdbbc1d.exe	26
PID 1720 wrote to memory of 1772	1720	371848ffcd0f0a70828f077ef8bb3c91abc4caabc7ec8cc4f73139ab6cdbbc1d.exe	26

C:\Users\Admin\AppData\Local\Temp\371848ffcd0f0a70828f077ef8bb3c91abc4caabc7ec8cc4f73139ab6cdbbc1d.exe
"C:\Users\Admin\AppData\Local\Temp\371848ffcd0f0a70828f077ef8bb3c91abc4caabc7ec8cc4f73139ab6cdbbc1d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 36
  2⤵
  - Program crash
  PID:1772

memory/1720-55-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download