088aef3ff7aba4b772b0c4d4cf22ccfd6f55411336b76d57ecc9b3b520bb7397

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 09:08

Target

088aef3ff7aba4b772b0c4d4cf22ccfd6f55411336b76d57ecc9b3b520bb7397.exe
Size

384KB
MD5

7ce2a6089bbad06db008580da695a892
SHA1

37fcd275d98aa2145cd4451cf8205ff1a42fb2e5
SHA256

088aef3ff7aba4b772b0c4d4cf22ccfd6f55411336b76d57ecc9b3b520bb7397
SHA512

159a238c00deba74329c95ab9d115046f70c88f3544fa745b8c59aa10e8841a09ef979fccdb104aaa33c7f31a8c6e8c0c1a6a958812d0f957022d0c7d77217ec
SSDEEP

6144:ryyElYDidHv/vDc6A4qjI1pJdOSBA71eK853fevVzgX5UVDAZYqppHwFHOA3ZGtH:qddP/vDc6A9jInJ8OA718mv5G5UV0ZYG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1428	2032	WerFault.exe	16

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1428	2032	088aef3ff7aba4b772b0c4d4cf22ccfd6f55411336b76d57ecc9b3b520bb7397.exe	27
PID 2032 wrote to memory of 1428	2032	088aef3ff7aba4b772b0c4d4cf22ccfd6f55411336b76d57ecc9b3b520bb7397.exe	27
PID 2032 wrote to memory of 1428	2032	088aef3ff7aba4b772b0c4d4cf22ccfd6f55411336b76d57ecc9b3b520bb7397.exe	27
PID 2032 wrote to memory of 1428	2032	088aef3ff7aba4b772b0c4d4cf22ccfd6f55411336b76d57ecc9b3b520bb7397.exe	27
PID 2032 wrote to memory of 1428	2032	088aef3ff7aba4b772b0c4d4cf22ccfd6f55411336b76d57ecc9b3b520bb7397.exe	27
PID 2032 wrote to memory of 1428	2032	088aef3ff7aba4b772b0c4d4cf22ccfd6f55411336b76d57ecc9b3b520bb7397.exe	27
PID 2032 wrote to memory of 1428	2032	088aef3ff7aba4b772b0c4d4cf22ccfd6f55411336b76d57ecc9b3b520bb7397.exe	27

C:\Users\Admin\AppData\Local\Temp\088aef3ff7aba4b772b0c4d4cf22ccfd6f55411336b76d57ecc9b3b520bb7397.exe
"C:\Users\Admin\AppData\Local\Temp\088aef3ff7aba4b772b0c4d4cf22ccfd6f55411336b76d57ecc9b3b520bb7397.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 256
  2⤵
  - Program crash
  PID:1428

memory/2032-54-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/2032-56-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2032-57-0x0000000000230000-0x0000000000292000-memory.dmp

Filesize
392KB

Download