58456189e5d48e511a1018f532b4d8bd72210ef238d2df92cf3e98d44473169d

Analysis

max time kernel
46s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 18:40

Target

58456189e5d48e511a1018f532b4d8bd72210ef238d2df92cf3e98d44473169d.exe
Size

320KB
MD5

a0482bdf78c42d65ab290894d969e080
SHA1

da48e1e9e734fbee0e73db8ee924960f0d092f43
SHA256

58456189e5d48e511a1018f532b4d8bd72210ef238d2df92cf3e98d44473169d
SHA512

3518444abf5060beb4427f92e65177d6666a3cc07125a898d7a33be7e401a96fb031f6ed14d7a1baa93202adb51461a12dee3ea8a417c1f4fb811b68bb755e23
SSDEEP

6144:cJfesGml6YoH2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:cQmlE2EB0NxDIBuOFe7/uT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1344	1204	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1344	1204	58456189e5d48e511a1018f532b4d8bd72210ef238d2df92cf3e98d44473169d.exe	27
PID 1204 wrote to memory of 1344	1204	58456189e5d48e511a1018f532b4d8bd72210ef238d2df92cf3e98d44473169d.exe	27
PID 1204 wrote to memory of 1344	1204	58456189e5d48e511a1018f532b4d8bd72210ef238d2df92cf3e98d44473169d.exe	27
PID 1204 wrote to memory of 1344	1204	58456189e5d48e511a1018f532b4d8bd72210ef238d2df92cf3e98d44473169d.exe	27

C:\Users\Admin\AppData\Local\Temp\58456189e5d48e511a1018f532b4d8bd72210ef238d2df92cf3e98d44473169d.exe
"C:\Users\Admin\AppData\Local\Temp\58456189e5d48e511a1018f532b4d8bd72210ef238d2df92cf3e98d44473169d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 36
  2⤵
  - Program crash
  PID:1344

memory/1204-55-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download