f71b0f6654dd5590b28f1f651ee82e9c5198c4a59b0a20f104d278aa1d5160dc

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 03:03

Target

f71b0f6654dd5590b28f1f651ee82e9c5198c4a59b0a20f104d278aa1d5160dc.exe
Size

262KB
MD5

801e46383104e9bbc5a08b2bb0140880
SHA1

46ca111210a2739a5229663b0fcd5383e2bdf480
SHA256

f71b0f6654dd5590b28f1f651ee82e9c5198c4a59b0a20f104d278aa1d5160dc
SHA512

ce92846e33662edffa55a230cbfd26ca32afabe883946e19d1d2a22f2ebc618f91c66fc68ad3b371cec289ad49732780290644a70e24cafc75608ff136ae7ca8
SSDEEP

6144:kRJy/8iUQkin5FbhLIDI1aeyIBbOzciQXdP:P/8fQjCQYIROzcicd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1264	2008	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1264	2008	f71b0f6654dd5590b28f1f651ee82e9c5198c4a59b0a20f104d278aa1d5160dc.exe	28
PID 2008 wrote to memory of 1264	2008	f71b0f6654dd5590b28f1f651ee82e9c5198c4a59b0a20f104d278aa1d5160dc.exe	28
PID 2008 wrote to memory of 1264	2008	f71b0f6654dd5590b28f1f651ee82e9c5198c4a59b0a20f104d278aa1d5160dc.exe	28
PID 2008 wrote to memory of 1264	2008	f71b0f6654dd5590b28f1f651ee82e9c5198c4a59b0a20f104d278aa1d5160dc.exe	28

C:\Users\Admin\AppData\Local\Temp\f71b0f6654dd5590b28f1f651ee82e9c5198c4a59b0a20f104d278aa1d5160dc.exe
"C:\Users\Admin\AppData\Local\Temp\f71b0f6654dd5590b28f1f651ee82e9c5198c4a59b0a20f104d278aa1d5160dc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 176
  2⤵
  - Program crash
  PID:1264

memory/2008-54-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/2008-56-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download