577853797641e074a68aafbfce22c092b965b4b2426a626e2c17ecb4c37494a6

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 18:41

Target

577853797641e074a68aafbfce22c092b965b4b2426a626e2c17ecb4c37494a6.exe
Size

111KB
MD5

a0661a75ce3c75a72bc35e235ec16880
SHA1

54989d32636b734187a3c4341183229807f49e1f
SHA256

577853797641e074a68aafbfce22c092b965b4b2426a626e2c17ecb4c37494a6
SHA512

a28b82f4cd21449d5baf477626ae2a699818168b5bb187485cd836dad8dc7ada2758ec1cabf9549387a001d7b86c47c768127ed4b97c8775e2986621736afc2b
SSDEEP

3072:1vxTYgRLBR4f+9xDYYqjBkMqhGKZTbPzfO:1xdZ4GveibZXz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1472	2020	WerFault.exe	9

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1472	2020	577853797641e074a68aafbfce22c092b965b4b2426a626e2c17ecb4c37494a6.exe	26
PID 2020 wrote to memory of 1472	2020	577853797641e074a68aafbfce22c092b965b4b2426a626e2c17ecb4c37494a6.exe	26
PID 2020 wrote to memory of 1472	2020	577853797641e074a68aafbfce22c092b965b4b2426a626e2c17ecb4c37494a6.exe	26
PID 2020 wrote to memory of 1472	2020	577853797641e074a68aafbfce22c092b965b4b2426a626e2c17ecb4c37494a6.exe	26

C:\Users\Admin\AppData\Local\Temp\577853797641e074a68aafbfce22c092b965b4b2426a626e2c17ecb4c37494a6.exe
"C:\Users\Admin\AppData\Local\Temp\577853797641e074a68aafbfce22c092b965b4b2426a626e2c17ecb4c37494a6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 36
  2⤵
  - Program crash
  PID:1472

memory/2020-54-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download