09022c51aa66eb6859c9dffaca0ea2d2af2f92026a3232c43042e0013430f222

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 17:13

Target

09022c51aa66eb6859c9dffaca0ea2d2af2f92026a3232c43042e0013430f222.exe
Size

488KB
MD5

82982af3688fa3df0c276fbc169503c0
SHA1

c5832844bb5e7ae082186f50d8c8d3c9047fe106
SHA256

09022c51aa66eb6859c9dffaca0ea2d2af2f92026a3232c43042e0013430f222
SHA512

2404248b3d3b124295473b21481aa2954ec26ecd3c8f018728a55861032a7e8afa20c98deb4f0885e21c8456406629a564fad9a84493397eeac1c4ab069bf32d
SSDEEP

6144:/xsruBmTvTIh809buL4vFnW3WnxtX/5Pg1gI:/xC059vuWnxtRSgI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2040	1228	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 2040	1228	09022c51aa66eb6859c9dffaca0ea2d2af2f92026a3232c43042e0013430f222.exe	27
PID 1228 wrote to memory of 2040	1228	09022c51aa66eb6859c9dffaca0ea2d2af2f92026a3232c43042e0013430f222.exe	27
PID 1228 wrote to memory of 2040	1228	09022c51aa66eb6859c9dffaca0ea2d2af2f92026a3232c43042e0013430f222.exe	27
PID 1228 wrote to memory of 2040	1228	09022c51aa66eb6859c9dffaca0ea2d2af2f92026a3232c43042e0013430f222.exe	27

C:\Users\Admin\AppData\Local\Temp\09022c51aa66eb6859c9dffaca0ea2d2af2f92026a3232c43042e0013430f222.exe
"C:\Users\Admin\AppData\Local\Temp\09022c51aa66eb6859c9dffaca0ea2d2af2f92026a3232c43042e0013430f222.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 36
  2⤵
  - Program crash
  PID:2040

memory/1228-55-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download