7b674463008befb7c8503ecb34d00ffa85eb3c2a5de7a991e72d4291f9859a96

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 23:36

Target

7b674463008befb7c8503ecb34d00ffa85eb3c2a5de7a991e72d4291f9859a96.exe
Size

320KB
MD5

0c01c7884de7f2b2232e012b4362f4e0
SHA1

589c2778c00ef7271aa76e7622a6f274f044f145
SHA256

7b674463008befb7c8503ecb34d00ffa85eb3c2a5de7a991e72d4291f9859a96
SHA512

164dd6929f0ccd805306722b1ce1407f65515768496ea422c989a9dfc2d2120cd0fd26c909439337552891ad0103f59d4ba18d2345af92630007832b337b4539
SSDEEP

6144:l5fjQhhlOjgJ+MH2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:loqa2EB0NxDIBuOFe7/uT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
684	1384	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 684	1384	7b674463008befb7c8503ecb34d00ffa85eb3c2a5de7a991e72d4291f9859a96.exe	27
PID 1384 wrote to memory of 684	1384	7b674463008befb7c8503ecb34d00ffa85eb3c2a5de7a991e72d4291f9859a96.exe	27
PID 1384 wrote to memory of 684	1384	7b674463008befb7c8503ecb34d00ffa85eb3c2a5de7a991e72d4291f9859a96.exe	27
PID 1384 wrote to memory of 684	1384	7b674463008befb7c8503ecb34d00ffa85eb3c2a5de7a991e72d4291f9859a96.exe	27

C:\Users\Admin\AppData\Local\Temp\7b674463008befb7c8503ecb34d00ffa85eb3c2a5de7a991e72d4291f9859a96.exe
"C:\Users\Admin\AppData\Local\Temp\7b674463008befb7c8503ecb34d00ffa85eb3c2a5de7a991e72d4291f9859a96.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 36
  2⤵
  - Program crash
  PID:684

memory/1384-55-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download