70c82c1f3b11e0758a71eb3c13d0fedc9f37e5e5717473ebaf8adc17f5d666d9

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 18:30

Target

70c82c1f3b11e0758a71eb3c13d0fedc9f37e5e5717473ebaf8adc17f5d666d9.exe
Size

245KB
MD5

01751f7f09ef042a180144b6761a35d6
SHA1

2f2222293af134db74fc0a356c14f6818f53f84b
SHA256

70c82c1f3b11e0758a71eb3c13d0fedc9f37e5e5717473ebaf8adc17f5d666d9
SHA512

b8e4f690e273e0c38f4d1d098ef275dc2cfa1676261ae15b5e4376a565a537f3245081b89c2dfc777bdfbbcd67c995387ad454b2445d7a6108040e55c5dfae06
SSDEEP

3072:TBucIy5lEaANR4Cpw5sANR4Cpw5RCpw5RCpw5sANR4Cpw5H:TBp/5lLy1w5sy1w5Kw5Kw5sy1w5H

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1220	1716	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1220	1716	70c82c1f3b11e0758a71eb3c13d0fedc9f37e5e5717473ebaf8adc17f5d666d9.exe	27
PID 1716 wrote to memory of 1220	1716	70c82c1f3b11e0758a71eb3c13d0fedc9f37e5e5717473ebaf8adc17f5d666d9.exe	27
PID 1716 wrote to memory of 1220	1716	70c82c1f3b11e0758a71eb3c13d0fedc9f37e5e5717473ebaf8adc17f5d666d9.exe	27
PID 1716 wrote to memory of 1220	1716	70c82c1f3b11e0758a71eb3c13d0fedc9f37e5e5717473ebaf8adc17f5d666d9.exe	27

C:\Users\Admin\AppData\Local\Temp\70c82c1f3b11e0758a71eb3c13d0fedc9f37e5e5717473ebaf8adc17f5d666d9.exe
"C:\Users\Admin\AppData\Local\Temp\70c82c1f3b11e0758a71eb3c13d0fedc9f37e5e5717473ebaf8adc17f5d666d9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 92
  2⤵
  - Program crash
  PID:1220

memory/1716-55-0x0000000000400000-0x000000000040536C-memory.dmp

Filesize
20KB

Download