622e070cf7de6b871982395d4f48c80f5e15eb1826dc04ab030720fee52c2d2e

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 10:50

Target

622e070cf7de6b871982395d4f48c80f5e15eb1826dc04ab030720fee52c2d2e.exe
Size

320KB
MD5

a2f20868e8c77e9ea5b4c3619702f380
SHA1

d77d095bc1d32afe2a88efbed5080cff66e785f7
SHA256

622e070cf7de6b871982395d4f48c80f5e15eb1826dc04ab030720fee52c2d2e
SHA512

e73dea7bcb3a34ec98f6b9a9d34bd6ccea10c7c1cebc9036417a06970f4774c5e791a8bb4ff42cdae5b4d21f4a453e58ac30880542e9bf3f0525baad900ea327
SSDEEP

6144:sQWFGE4H2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:sBFGZ2EB0NxDIBuOFe7/uT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
780	1652	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 780	1652	622e070cf7de6b871982395d4f48c80f5e15eb1826dc04ab030720fee52c2d2e.exe	28
PID 1652 wrote to memory of 780	1652	622e070cf7de6b871982395d4f48c80f5e15eb1826dc04ab030720fee52c2d2e.exe	28
PID 1652 wrote to memory of 780	1652	622e070cf7de6b871982395d4f48c80f5e15eb1826dc04ab030720fee52c2d2e.exe	28
PID 1652 wrote to memory of 780	1652	622e070cf7de6b871982395d4f48c80f5e15eb1826dc04ab030720fee52c2d2e.exe	28

C:\Users\Admin\AppData\Local\Temp\622e070cf7de6b871982395d4f48c80f5e15eb1826dc04ab030720fee52c2d2e.exe
"C:\Users\Admin\AppData\Local\Temp\622e070cf7de6b871982395d4f48c80f5e15eb1826dc04ab030720fee52c2d2e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 36
  2⤵
  - Program crash
  PID:780

memory/1652-55-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download