3128ef32c1a722b7613868c5ccafce6d3f46288f2d8be3ab5c9dfd469d06bcda

Analysis

max time kernel
71s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31/10/2022, 00:17

Target

3128ef32c1a722b7613868c5ccafce6d3f46288f2d8be3ab5c9dfd469d06bcda.exe
Size

415KB
MD5

918824bc95b655d41a36d3639cb43d50
SHA1

bddb76ef06d33672fedf989b8a76b02af617cd0d
SHA256

3128ef32c1a722b7613868c5ccafce6d3f46288f2d8be3ab5c9dfd469d06bcda
SHA512

286ebbdc54a4db5a37c9fb17418f7bb5512379ab67d639453d2fc9746419dd2901ab912ba577486ee242e75fe74ef3b17e7aeb30c52fabd522e8799dcd5e2f21
SSDEEP

12288:bHWT4GwIEGpzK6FSkFv5SX1hqwE5nRYA1EZSsPn:bs4G/5pzvO3qz931EZSon

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1544	1968	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1544	1968	3128ef32c1a722b7613868c5ccafce6d3f46288f2d8be3ab5c9dfd469d06bcda.exe	27
PID 1968 wrote to memory of 1544	1968	3128ef32c1a722b7613868c5ccafce6d3f46288f2d8be3ab5c9dfd469d06bcda.exe	27
PID 1968 wrote to memory of 1544	1968	3128ef32c1a722b7613868c5ccafce6d3f46288f2d8be3ab5c9dfd469d06bcda.exe	27
PID 1968 wrote to memory of 1544	1968	3128ef32c1a722b7613868c5ccafce6d3f46288f2d8be3ab5c9dfd469d06bcda.exe	27

C:\Users\Admin\AppData\Local\Temp\3128ef32c1a722b7613868c5ccafce6d3f46288f2d8be3ab5c9dfd469d06bcda.exe
"C:\Users\Admin\AppData\Local\Temp\3128ef32c1a722b7613868c5ccafce6d3f46288f2d8be3ab5c9dfd469d06bcda.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 160
  2⤵
  - Program crash
  PID:1544

memory/1968-54-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/1968-55-0x0000000010000000-0x0000000010076000-memory.dmp

Filesize
472KB

Download
memory/1968-57-0x0000000010000000-0x0000000010076000-memory.dmp

Filesize
472KB

Download