476e19e2f9f19cd8d0f8f9fd49dbe76e0b3e5ffce1b158325c68f1a417fc0680

Analysis

max time kernel
25s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 07:36

Target

476e19e2f9f19cd8d0f8f9fd49dbe76e0b3e5ffce1b158325c68f1a417fc0680.exe
Size

100KB
MD5

7420e68e191e7adbdfb098bea5a17170
SHA1

54154ec20f444be8806c55456d58ff9666f2a4a2
SHA256

476e19e2f9f19cd8d0f8f9fd49dbe76e0b3e5ffce1b158325c68f1a417fc0680
SHA512

8b53a734f4a95a76e3416f606ad9f57bb62cc4f6575a7cf9183b70d17b0c4ab425418e13f4b6ba5b19556a37eab926f23861e76614bef65333342293792c0191
SSDEEP

3072:BI4xmLptQ14lkxvRi3Bc2MGys8JF7/Hggm0miHynJjp:BApmMkxvRyYH1Y4IT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1756	904	WerFault.exe	7

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 1756	904	476e19e2f9f19cd8d0f8f9fd49dbe76e0b3e5ffce1b158325c68f1a417fc0680.exe	28
PID 904 wrote to memory of 1756	904	476e19e2f9f19cd8d0f8f9fd49dbe76e0b3e5ffce1b158325c68f1a417fc0680.exe	28
PID 904 wrote to memory of 1756	904	476e19e2f9f19cd8d0f8f9fd49dbe76e0b3e5ffce1b158325c68f1a417fc0680.exe	28
PID 904 wrote to memory of 1756	904	476e19e2f9f19cd8d0f8f9fd49dbe76e0b3e5ffce1b158325c68f1a417fc0680.exe	28

C:\Users\Admin\AppData\Local\Temp\476e19e2f9f19cd8d0f8f9fd49dbe76e0b3e5ffce1b158325c68f1a417fc0680.exe
"C:\Users\Admin\AppData\Local\Temp\476e19e2f9f19cd8d0f8f9fd49dbe76e0b3e5ffce1b158325c68f1a417fc0680.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 36
  2⤵
  - Program crash
  PID:1756

memory/904-55-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download