44264beecd758ab247ade0cd28db1b019af159202438a0708a956cbe4a234c44

Analysis

max time kernel
419s
max time network
422s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-10-2022 00:07

Target

514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54_unpacked_dropper.exe
Size

352KB
MD5

e27edfdff2db563ca367d20e0deec389
SHA1

48597d839b5560a5418cf84c5bca750aa7fd092e
SHA256

44264beecd758ab247ade0cd28db1b019af159202438a0708a956cbe4a234c44
SHA512

97a4358f3804efaa7c10f485d7b35af17a0c3dcd107f07f49da09107f86ff70d25ffdea837c723a9f63ef2ea50de299e4f22f24ea21826aef12038dfba34fc8d
SSDEEP

6144:iPSROmLBk0/s7qbnWNFJcV9z+g4dlJ2j7vn9AUovLhuDCl9L0/ePQKYFcfu:/Oos2WNDW9PMUZ2llZbMcf

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

896 1964 WerFault.exe 514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54_unpacked_dropper.exe

pid	pid_target	process	target process
896	1964	WerFault.exe	514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54_unpacked_dropper.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54_unpacked_dropper.exe

description	pid	process	target process
PID 1964 wrote to memory of 896	1964	514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54_unpacked_dropper.exe	WerFault.exe
PID 1964 wrote to memory of 896	1964	514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54_unpacked_dropper.exe	WerFault.exe
PID 1964 wrote to memory of 896	1964	514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54_unpacked_dropper.exe	WerFault.exe
PID 1964 wrote to memory of 896	1964	514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54_unpacked_dropper.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54_unpacked_dropper.exe
"C:\Users\Admin\AppData\Local\Temp\514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54_unpacked_dropper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 180
2⤵
- Program crash
PID:896

memory/896-55-0x0000000000000000-mapping.dmp

Download
memory/1964-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download