29e2175c64aa4f45cedbf44fb11689e29fcf037a99e4861047940331993230bc

Analysis

max time kernel
27s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 22:14

Target

29e2175c64aa4f45cedbf44fb11689e29fcf037a99e4861047940331993230bc.exe
Size

168KB
MD5

a2490696b2275d0ef173910d1d694370
SHA1

d8b61219d802dca6be9968a8ba7851b03bb609f4
SHA256

29e2175c64aa4f45cedbf44fb11689e29fcf037a99e4861047940331993230bc
SHA512

f75e57db995bc4695643004ae7595b236707f4bf31b7d4e0caa5a631508c66d42dc699012850f6f2b2f55154b25168915638b2fe643c5737199f5cc849570de0
SSDEEP

3072:LqPL1/7w6ZAs+VBK3NtubNVFywb9Ve4kZJcMKQv+C25MOLdUr9hoO:0QVujubNawb9VOExRCiMOEo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
304	1072	WerFault.exe	12

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 304	1072	29e2175c64aa4f45cedbf44fb11689e29fcf037a99e4861047940331993230bc.exe	27
PID 1072 wrote to memory of 304	1072	29e2175c64aa4f45cedbf44fb11689e29fcf037a99e4861047940331993230bc.exe	27
PID 1072 wrote to memory of 304	1072	29e2175c64aa4f45cedbf44fb11689e29fcf037a99e4861047940331993230bc.exe	27
PID 1072 wrote to memory of 304	1072	29e2175c64aa4f45cedbf44fb11689e29fcf037a99e4861047940331993230bc.exe	27

C:\Users\Admin\AppData\Local\Temp\29e2175c64aa4f45cedbf44fb11689e29fcf037a99e4861047940331993230bc.exe
"C:\Users\Admin\AppData\Local\Temp\29e2175c64aa4f45cedbf44fb11689e29fcf037a99e4861047940331993230bc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 132
  2⤵
  - Program crash
  PID:304

memory/1072-55-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download