79d4d201b9fc8dcb5bd4b6af263e57ea5e9f29104181e26f500216ec4a229e6a

Analysis

max time kernel
29s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 18:37

Target

79d4d201b9fc8dcb5bd4b6af263e57ea5e9f29104181e26f500216ec4a229e6a.exe
Size

320KB
MD5

a00a5e1fb368036284b18394a105b060
SHA1

7259c51976f71d4cdec1974199a49a45e798d415
SHA256

79d4d201b9fc8dcb5bd4b6af263e57ea5e9f29104181e26f500216ec4a229e6a
SHA512

6e44141dc57f786867ea16c3f8280c3c63e9500d5871c28905c233adf448f5dbcd3aa44080e41a37c077a0ad22f56929c40b4562f74022b093c34952d48f20e1
SSDEEP

6144:Q59NnDexnGMH2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:Q5HexnGa2EB0NxDIBuOFe7/uT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1976	1628	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1976	1628	79d4d201b9fc8dcb5bd4b6af263e57ea5e9f29104181e26f500216ec4a229e6a.exe	28
PID 1628 wrote to memory of 1976	1628	79d4d201b9fc8dcb5bd4b6af263e57ea5e9f29104181e26f500216ec4a229e6a.exe	28
PID 1628 wrote to memory of 1976	1628	79d4d201b9fc8dcb5bd4b6af263e57ea5e9f29104181e26f500216ec4a229e6a.exe	28
PID 1628 wrote to memory of 1976	1628	79d4d201b9fc8dcb5bd4b6af263e57ea5e9f29104181e26f500216ec4a229e6a.exe	28

C:\Users\Admin\AppData\Local\Temp\79d4d201b9fc8dcb5bd4b6af263e57ea5e9f29104181e26f500216ec4a229e6a.exe
"C:\Users\Admin\AppData\Local\Temp\79d4d201b9fc8dcb5bd4b6af263e57ea5e9f29104181e26f500216ec4a229e6a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 36
  2⤵
  - Program crash
  PID:1976

memory/1628-55-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download