be13b2b600449828fe05b8593298f7ccd1e62ebbc1d1fc5cd0a81f27a63d2320

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 23:48

Target

be13b2b600449828fe05b8593298f7ccd1e62ebbc1d1fc5cd0a81f27a63d2320.exe
Size

28KB
MD5

4ef22695d557b7b0cfd31265438c56d0
SHA1

437e4ce6642403b4b2f86effbf941f5402bf68d3
SHA256

be13b2b600449828fe05b8593298f7ccd1e62ebbc1d1fc5cd0a81f27a63d2320
SHA512

9cafe6b25860750b2b8ef4c286898adf4c94d7487b3383fa2ce230e447e0c451cc1416a788cf7cb64d9b7ca8260f502e652d66d80ca3663991e54c5b886757e1
SSDEEP

384:imOyuLjpMPH1Dxw7ZA8F9ZoA7k+w9GHhmssR0IkR4Inzo6m8m+BRtssIeo/r5tEs:zWjpVjF9x23xInzx9T1wrf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1676	1092	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1676	1092	be13b2b600449828fe05b8593298f7ccd1e62ebbc1d1fc5cd0a81f27a63d2320.exe	27
PID 1092 wrote to memory of 1676	1092	be13b2b600449828fe05b8593298f7ccd1e62ebbc1d1fc5cd0a81f27a63d2320.exe	27
PID 1092 wrote to memory of 1676	1092	be13b2b600449828fe05b8593298f7ccd1e62ebbc1d1fc5cd0a81f27a63d2320.exe	27
PID 1092 wrote to memory of 1676	1092	be13b2b600449828fe05b8593298f7ccd1e62ebbc1d1fc5cd0a81f27a63d2320.exe	27

C:\Users\Admin\AppData\Local\Temp\be13b2b600449828fe05b8593298f7ccd1e62ebbc1d1fc5cd0a81f27a63d2320.exe
"C:\Users\Admin\AppData\Local\Temp\be13b2b600449828fe05b8593298f7ccd1e62ebbc1d1fc5cd0a81f27a63d2320.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 36
  2⤵
  - Program crash
  PID:1676

memory/1092-55-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1676-54-0x0000000000000000-mapping.dmp

Download