3463dc7fc9bd0c6f4aa4e4d42ff532cb897c2c2c35c7e9af8e4a0bc7e2a8d9e1

Analysis

max time kernel
48s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 11:01

Target

3463dc7fc9bd0c6f4aa4e4d42ff532cb897c2c2c35c7e9af8e4a0bc7e2a8d9e1.exe
Size

320KB
MD5

a27a97d92bfae892d74b3d48c30f91b0
SHA1

5f50e4efa2ba0f5d2256874a8c23d86c60143da6
SHA256

3463dc7fc9bd0c6f4aa4e4d42ff532cb897c2c2c35c7e9af8e4a0bc7e2a8d9e1
SHA512

33ee840c67584fd39fa4adfce35da7a64ee95575e4c16513ced905359d7a9ed5f7331e9f821a6affa42371abed1da47bf9aa733c4a9749603ef4212e0bc72493
SSDEEP

6144:JyAMb7GlZBIae42lH2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:gAMKZG4212EB0NxDIBuOFe7/uT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1524	1288	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 1524	1288	3463dc7fc9bd0c6f4aa4e4d42ff532cb897c2c2c35c7e9af8e4a0bc7e2a8d9e1.exe	27
PID 1288 wrote to memory of 1524	1288	3463dc7fc9bd0c6f4aa4e4d42ff532cb897c2c2c35c7e9af8e4a0bc7e2a8d9e1.exe	27
PID 1288 wrote to memory of 1524	1288	3463dc7fc9bd0c6f4aa4e4d42ff532cb897c2c2c35c7e9af8e4a0bc7e2a8d9e1.exe	27
PID 1288 wrote to memory of 1524	1288	3463dc7fc9bd0c6f4aa4e4d42ff532cb897c2c2c35c7e9af8e4a0bc7e2a8d9e1.exe	27

C:\Users\Admin\AppData\Local\Temp\3463dc7fc9bd0c6f4aa4e4d42ff532cb897c2c2c35c7e9af8e4a0bc7e2a8d9e1.exe
"C:\Users\Admin\AppData\Local\Temp\3463dc7fc9bd0c6f4aa4e4d42ff532cb897c2c2c35c7e9af8e4a0bc7e2a8d9e1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 36
  2⤵
  - Program crash
  PID:1524

memory/1288-55-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download