217831226a3f69dc927d01f6696315294fcf7c9738ba9955bdbffbd9076ea0aa

Analysis

max time kernel
430s
max time network
432s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-10-2022 00:03

Target

2952a6ad1ba0a56ea176672f3ec9b1ad8a92836839dc51f592eb253db60c96af_unpacked_dropper.exe
Size

367KB
MD5

45c3677c1f85d800c5ff3d0783bc0472
SHA1

38b7e90f6c5bd955a6d14d5b9f86fb22e9cc8020
SHA256

217831226a3f69dc927d01f6696315294fcf7c9738ba9955bdbffbd9076ea0aa
SHA512

eee6f4f7e6fc1975b1383e785fb638ee190b3692edb005cd094eada268954d7daea77e229f2a7928be3a01b04152f476293f02db5693776a70a03b9a76b839eb
SSDEEP

6144:UvBWQQqJizCS6EEXMvZyRC7YmqY28nzXLFy9wvK7SEg7b03oW8rykdvuj5dS17ui:U5WQBE8FX+ZZ77qYBgKv4Xg5RryGWldY

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1456 1212 WerFault.exe 2952a6ad1ba0a56ea176672f3ec9b1ad8a92836839dc51f592eb253db60c96af_unpacked_dropper.exe

pid	pid_target	process	target process
1456	1212	WerFault.exe	2952a6ad1ba0a56ea176672f3ec9b1ad8a92836839dc51f592eb253db60c96af_unpacked_dropper.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2952a6ad1ba0a56ea176672f3ec9b1ad8a92836839dc51f592eb253db60c96af_unpacked_dropper.exe

description	pid	process	target process
PID 1212 wrote to memory of 1456	1212	2952a6ad1ba0a56ea176672f3ec9b1ad8a92836839dc51f592eb253db60c96af_unpacked_dropper.exe	WerFault.exe
PID 1212 wrote to memory of 1456	1212	2952a6ad1ba0a56ea176672f3ec9b1ad8a92836839dc51f592eb253db60c96af_unpacked_dropper.exe	WerFault.exe
PID 1212 wrote to memory of 1456	1212	2952a6ad1ba0a56ea176672f3ec9b1ad8a92836839dc51f592eb253db60c96af_unpacked_dropper.exe	WerFault.exe
PID 1212 wrote to memory of 1456	1212	2952a6ad1ba0a56ea176672f3ec9b1ad8a92836839dc51f592eb253db60c96af_unpacked_dropper.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2952a6ad1ba0a56ea176672f3ec9b1ad8a92836839dc51f592eb253db60c96af_unpacked_dropper.exe
"C:\Users\Admin\AppData\Local\Temp\2952a6ad1ba0a56ea176672f3ec9b1ad8a92836839dc51f592eb253db60c96af_unpacked_dropper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 156
2⤵
- Program crash
PID:1456

memory/1212-54-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download
memory/1456-55-0x0000000000000000-mapping.dmp

Download