7077077fa72dba23ad7fef61950af75271b059907d719a7e0d85fcedb57fa1ba

Analysis

max time kernel
27s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 03:55

Target

7077077fa72dba23ad7fef61950af75271b059907d719a7e0d85fcedb57fa1ba.exe
Size

56KB
MD5

712d39cf2a690e1a44f4eb1fd03d6560
SHA1

ad738be56a855021ef47df3e1ab48d8484277758
SHA256

7077077fa72dba23ad7fef61950af75271b059907d719a7e0d85fcedb57fa1ba
SHA512

65a0efdad71f816480ed8c1a217bd2880ccc77d7ec7411ba10252a7a8b5e424ac05cd5d79b5251d41df47179785e82f640b51a5fd87deedfc4794d80d3beac2d
SSDEEP

1536:6X4Km1IwSY+A37feaCMJDmYsLIb4PvYqHB/Agg:w4F6wSDADeak7dJHB/AP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2000	1896	WerFault.exe	22

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2000	1896	7077077fa72dba23ad7fef61950af75271b059907d719a7e0d85fcedb57fa1ba.exe	28
PID 1896 wrote to memory of 2000	1896	7077077fa72dba23ad7fef61950af75271b059907d719a7e0d85fcedb57fa1ba.exe	28
PID 1896 wrote to memory of 2000	1896	7077077fa72dba23ad7fef61950af75271b059907d719a7e0d85fcedb57fa1ba.exe	28
PID 1896 wrote to memory of 2000	1896	7077077fa72dba23ad7fef61950af75271b059907d719a7e0d85fcedb57fa1ba.exe	28

C:\Users\Admin\AppData\Local\Temp\7077077fa72dba23ad7fef61950af75271b059907d719a7e0d85fcedb57fa1ba.exe
"C:\Users\Admin\AppData\Local\Temp\7077077fa72dba23ad7fef61950af75271b059907d719a7e0d85fcedb57fa1ba.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 120
  2⤵
  - Program crash
  PID:2000

memory/1896-54-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download
memory/1896-56-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download