39a5416853b9335caf605ccc71e0a148961728dcccb3fbab579e986bd81ad42a

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
31-10-2022 00:17

Target

39a5416853b9335caf605ccc71e0a148961728dcccb3fbab579e986bd81ad42a.exe
Size

190KB
MD5

a24343cdcc91af3b798052f7c0f8aaa0
SHA1

33d09b3175bbc59e0d723409d34e5fc08c7333a1
SHA256

39a5416853b9335caf605ccc71e0a148961728dcccb3fbab579e986bd81ad42a
SHA512

2c83f39a476f175696f3f0fdf9b4ff749c6a7658e2b3eb7594cbc719f010d80c32e1134bab4aad7552b917a93c49f31e39d1901144632881421aab2b8fc7f69e
SSDEEP

3072:KYdLQjO2zyo5n1J52xKkxNJ6kzaBQmsKBRpdLPaucPzoI7h+aS1G+:KwLmzj1axFNJvzfKfHP9cPzo0naG+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1124	1468	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1124	1468	39a5416853b9335caf605ccc71e0a148961728dcccb3fbab579e986bd81ad42a.exe	27
PID 1468 wrote to memory of 1124	1468	39a5416853b9335caf605ccc71e0a148961728dcccb3fbab579e986bd81ad42a.exe	27
PID 1468 wrote to memory of 1124	1468	39a5416853b9335caf605ccc71e0a148961728dcccb3fbab579e986bd81ad42a.exe	27
PID 1468 wrote to memory of 1124	1468	39a5416853b9335caf605ccc71e0a148961728dcccb3fbab579e986bd81ad42a.exe	27

C:\Users\Admin\AppData\Local\Temp\39a5416853b9335caf605ccc71e0a148961728dcccb3fbab579e986bd81ad42a.exe
"C:\Users\Admin\AppData\Local\Temp\39a5416853b9335caf605ccc71e0a148961728dcccb3fbab579e986bd81ad42a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 116
  2⤵
  - Program crash
  PID:1124

memory/1124-55-0x0000000000000000-mapping.dmp

Download
memory/1468-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1468-56-0x0000000000B40000-0x0000000000B74000-memory.dmp

Filesize
208KB

Download