26445d1438b05cd09e9111776352f536813c0f6bdcea81ff49f9613e397819c0

Analysis

max time kernel
41s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 03:35

Target

26445d1438b05cd09e9111776352f536813c0f6bdcea81ff49f9613e397819c0.exe
Size

239KB
MD5

557abf1f1297005d4a12592da30c5940
SHA1

b7e0d5c8802bb06a53e8a5c0ff1b8a375d818546
SHA256

26445d1438b05cd09e9111776352f536813c0f6bdcea81ff49f9613e397819c0
SHA512

a64cca38ff75941523ebdaab28e08bee21910aac5c119bca86450e5007157daed308b4705942d7b7c0e990edefec068f590d0bd070496cc8f0f3580151ab4b54
SSDEEP

3072:fJE9RIlj9sUGkKyQabYMkTgeLT+w2EC4j0oYb8e+jmbH7EMOjxxHr6xxr6GVyaFw:C9RiOyQlTgALXqo1jmUZxL6xQGQgg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
620	1276	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 620	1276	26445d1438b05cd09e9111776352f536813c0f6bdcea81ff49f9613e397819c0.exe	27
PID 1276 wrote to memory of 620	1276	26445d1438b05cd09e9111776352f536813c0f6bdcea81ff49f9613e397819c0.exe	27
PID 1276 wrote to memory of 620	1276	26445d1438b05cd09e9111776352f536813c0f6bdcea81ff49f9613e397819c0.exe	27
PID 1276 wrote to memory of 620	1276	26445d1438b05cd09e9111776352f536813c0f6bdcea81ff49f9613e397819c0.exe	27

C:\Users\Admin\AppData\Local\Temp\26445d1438b05cd09e9111776352f536813c0f6bdcea81ff49f9613e397819c0.exe
"C:\Users\Admin\AppData\Local\Temp\26445d1438b05cd09e9111776352f536813c0f6bdcea81ff49f9613e397819c0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 152
  2⤵
  - Program crash
  PID:620

memory/1276-55-0x0000000001000000-0x0000000001040000-memory.dmp

Filesize
256KB

Download