01c893d959bc0add9d94879420e4ae2a28d950792f4d1ddea7208def412642d2

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 11:11

Target

01c893d959bc0add9d94879420e4ae2a28d950792f4d1ddea7208def412642d2.exe
Size

83KB
MD5

92fe2752d08ad7708cf53c03cadc2740
SHA1

6e3bdaaec9cec133f3d28b0ea93ace3abb90aa8d
SHA256

01c893d959bc0add9d94879420e4ae2a28d950792f4d1ddea7208def412642d2
SHA512

1d569657e453d7ac4c8a9abe8790553c0883c31a9a8f5ce7ebd4413c5fd782b70b3bad8b93510ae577f4e86e41acc74809ee1bb85370674a4e36e55951f31d62
SSDEEP

1536:fvm/USCcPPhMLis1svN+dWVL9NnFV5wh8/0cPC1SqqP1kHzspjVrs2ryrd1vUQun:V/EPFNAdOXnWzcPC81PdHs2q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1568	968	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 1568	968	01c893d959bc0add9d94879420e4ae2a28d950792f4d1ddea7208def412642d2.exe	27
PID 968 wrote to memory of 1568	968	01c893d959bc0add9d94879420e4ae2a28d950792f4d1ddea7208def412642d2.exe	27
PID 968 wrote to memory of 1568	968	01c893d959bc0add9d94879420e4ae2a28d950792f4d1ddea7208def412642d2.exe	27
PID 968 wrote to memory of 1568	968	01c893d959bc0add9d94879420e4ae2a28d950792f4d1ddea7208def412642d2.exe	27

C:\Users\Admin\AppData\Local\Temp\01c893d959bc0add9d94879420e4ae2a28d950792f4d1ddea7208def412642d2.exe
"C:\Users\Admin\AppData\Local\Temp\01c893d959bc0add9d94879420e4ae2a28d950792f4d1ddea7208def412642d2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 36
  2⤵
  - Program crash
  PID:1568

memory/968-55-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download