605e404285975a68926b7239b528e59b80924add8df774001f300ade4e795e51

Analysis

max time kernel
8s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 20:09

Target

605e404285975a68926b7239b528e59b80924add8df774001f300ade4e795e51.exe
Size

76KB
MD5

a16a2136bcd98d770737eb40a0598fa0
SHA1

00a337026a74db21bf22718429516452ff14aa8a
SHA256

605e404285975a68926b7239b528e59b80924add8df774001f300ade4e795e51
SHA512

994fd5345b05768f66691720afd07024b779c8af19f26ad9562ddc752c8a3f85d731b24844db0853d095b60746e0bc67a59fd14e8907e6794a1be79fed3da0db
SSDEEP

1536:UkcBq1WRNLwM4UuSl8S81ig3gOxijmAxEvaEFRll30jTjEErxTWDTMqhGKYIZTEM:Uk0q1WoMyS1aigbiqAKvaEFlE/jBkMqR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1888	2028	WerFault.exe	8

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1888	2028	605e404285975a68926b7239b528e59b80924add8df774001f300ade4e795e51.exe	28
PID 2028 wrote to memory of 1888	2028	605e404285975a68926b7239b528e59b80924add8df774001f300ade4e795e51.exe	28
PID 2028 wrote to memory of 1888	2028	605e404285975a68926b7239b528e59b80924add8df774001f300ade4e795e51.exe	28
PID 2028 wrote to memory of 1888	2028	605e404285975a68926b7239b528e59b80924add8df774001f300ade4e795e51.exe	28

C:\Users\Admin\AppData\Local\Temp\605e404285975a68926b7239b528e59b80924add8df774001f300ade4e795e51.exe
"C:\Users\Admin\AppData\Local\Temp\605e404285975a68926b7239b528e59b80924add8df774001f300ade4e795e51.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 36
  2⤵
  - Program crash
  PID:1888

memory/2028-55-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download