2f26dc64cbd1ab52f3e6696414a9f4dbbb7e1f897e6b94c184c2f8b4a920e5d4

Analysis

max time kernel
22s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 07:34

Target

2f26dc64cbd1ab52f3e6696414a9f4dbbb7e1f897e6b94c184c2f8b4a920e5d4.exe
Size

76KB
MD5

7652d3d287af7433f690d1e089acd19a
SHA1

eb2c4047a5e01440484a5cf0cd7574280db3a7a3
SHA256

2f26dc64cbd1ab52f3e6696414a9f4dbbb7e1f897e6b94c184c2f8b4a920e5d4
SHA512

7c1f00b3b15b27befce13351455db69d0fd9a18dfe5d36c725e418235ba4066ca51268d7a58a94b006cff54eb160815d2cdc9c89c800799aef8cb6cd66480c96
SSDEEP

1536:0xYwM3OiUsngxzWkWBjmzvmA4GHfFfzJIl7dB7f1SxDamKPzyrEhiaZOW7PQc9iP:8VRZ2NT4mHpDXRU/Hs2qo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1800	288	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 1800	288	2f26dc64cbd1ab52f3e6696414a9f4dbbb7e1f897e6b94c184c2f8b4a920e5d4.exe	27
PID 288 wrote to memory of 1800	288	2f26dc64cbd1ab52f3e6696414a9f4dbbb7e1f897e6b94c184c2f8b4a920e5d4.exe	27
PID 288 wrote to memory of 1800	288	2f26dc64cbd1ab52f3e6696414a9f4dbbb7e1f897e6b94c184c2f8b4a920e5d4.exe	27
PID 288 wrote to memory of 1800	288	2f26dc64cbd1ab52f3e6696414a9f4dbbb7e1f897e6b94c184c2f8b4a920e5d4.exe	27

C:\Users\Admin\AppData\Local\Temp\2f26dc64cbd1ab52f3e6696414a9f4dbbb7e1f897e6b94c184c2f8b4a920e5d4.exe
"C:\Users\Admin\AppData\Local\Temp\2f26dc64cbd1ab52f3e6696414a9f4dbbb7e1f897e6b94c184c2f8b4a920e5d4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 288 -s 36
  2⤵
  - Program crash
  PID:1800

memory/288-55-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download