7b6cfa0bb9b5fbb0bedddb5ee9c12fc4d0a9fb4d6e0ffc85f34e942617564f74

Analysis

max time kernel
37s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 22:36

Target

7b6cfa0bb9b5fbb0bedddb5ee9c12fc4d0a9fb4d6e0ffc85f34e942617564f74.exe
Size

176KB
MD5

0b1df894a38dd397859b65933045c390
SHA1

4408e141b07d1cc3a228b56e4ff6a6456ac72d1b
SHA256

7b6cfa0bb9b5fbb0bedddb5ee9c12fc4d0a9fb4d6e0ffc85f34e942617564f74
SHA512

eda41e6e1e88e0aa190104833eb9d1776890a37559a6fb999f5f90a1924930866af56b3746bc8209859134292ad415ea0558bbd2e16e345a8c321bdcfc538cad
SSDEEP

3072:EQz7B2o17S5LYdSrY9pYrj2hsBPBzsdhzV3v+SNyD+AXet33eSTVw:t7B2olS50r9pYHBJgZ3mStA+3O8w

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1792	1476	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1792	1476	7b6cfa0bb9b5fbb0bedddb5ee9c12fc4d0a9fb4d6e0ffc85f34e942617564f74.exe	27
PID 1476 wrote to memory of 1792	1476	7b6cfa0bb9b5fbb0bedddb5ee9c12fc4d0a9fb4d6e0ffc85f34e942617564f74.exe	27
PID 1476 wrote to memory of 1792	1476	7b6cfa0bb9b5fbb0bedddb5ee9c12fc4d0a9fb4d6e0ffc85f34e942617564f74.exe	27

C:\Users\Admin\AppData\Local\Temp\7b6cfa0bb9b5fbb0bedddb5ee9c12fc4d0a9fb4d6e0ffc85f34e942617564f74.exe
"C:\Users\Admin\AppData\Local\Temp\7b6cfa0bb9b5fbb0bedddb5ee9c12fc4d0a9fb4d6e0ffc85f34e942617564f74.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1476 -s 520
  2⤵
  - Program crash
  PID:1792

memory/1476-54-0x0000000000EF0000-0x0000000000F1E000-memory.dmp

Filesize
184KB

Download