b95931dbc93f04c382f0a24e12fe2a47f58828c1c5aa0a95f87a015133f3a0aa

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 23:41

Target

b95931dbc93f04c382f0a24e12fe2a47f58828c1c5aa0a95f87a015133f3a0aa.exe
Size

77KB
MD5

14a2938d451c32ba53cf4a65a6e8eb1e
SHA1

724f2b607d58268de69d46ad9fe98681b01c7643
SHA256

b95931dbc93f04c382f0a24e12fe2a47f58828c1c5aa0a95f87a015133f3a0aa
SHA512

1c6306ab8ecdd5624acffb1f2a7d7211574ec85240298a829fc9cf9945fac79fa72d77f2944c944d1eb7065694405e5d4eaec8684267c2d0048ee8092d820d03
SSDEEP

1536:eDqr21Ehc/CQZ/uMPEayxNpAHxT9pZ5OAzH9qaQC:eur2Snk/LcayxNSRfZX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	1740	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1708	1740	b95931dbc93f04c382f0a24e12fe2a47f58828c1c5aa0a95f87a015133f3a0aa.exe	27
PID 1740 wrote to memory of 1708	1740	b95931dbc93f04c382f0a24e12fe2a47f58828c1c5aa0a95f87a015133f3a0aa.exe	27
PID 1740 wrote to memory of 1708	1740	b95931dbc93f04c382f0a24e12fe2a47f58828c1c5aa0a95f87a015133f3a0aa.exe	27
PID 1740 wrote to memory of 1708	1740	b95931dbc93f04c382f0a24e12fe2a47f58828c1c5aa0a95f87a015133f3a0aa.exe	27

C:\Users\Admin\AppData\Local\Temp\b95931dbc93f04c382f0a24e12fe2a47f58828c1c5aa0a95f87a015133f3a0aa.exe
"C:\Users\Admin\AppData\Local\Temp\b95931dbc93f04c382f0a24e12fe2a47f58828c1c5aa0a95f87a015133f3a0aa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 72
  2⤵
  - Program crash
  PID:1708

memory/1740-55-0x00000000000B0000-0x00000000000C5000-memory.dmp

Filesize
84KB

Download