7220f9ec81df613dd5f9e83664e117948477ffb8462e908ed5deb6147b91b522

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/11/2022, 06:20

Target

7220f9ec81df613dd5f9e83664e117948477ffb8462e908ed5deb6147b91b522.exe
Size

143KB
MD5

ab7d89e13ff9e9ef7254fd4ef2d390f3
SHA1

fbefe6fa090a3522f2ee6ddf577a514363061bc7
SHA256

7220f9ec81df613dd5f9e83664e117948477ffb8462e908ed5deb6147b91b522
SHA512

7caa355ebb8dddffcb7771ef137218ffdf89f70fc8227abecb4d290c8818a25e38eee6f58379a0598adbc49a35c53bad8619182305a9f14a07757f1a46458f32
SSDEEP

3072:o+HcL2ICf4TntqSQRruiMZMqqDL2/AwvdM7Vjp9:hADtORruiMyqqDL6tvdOp9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	1516	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2012	1516	7220f9ec81df613dd5f9e83664e117948477ffb8462e908ed5deb6147b91b522.exe	27
PID 1516 wrote to memory of 2012	1516	7220f9ec81df613dd5f9e83664e117948477ffb8462e908ed5deb6147b91b522.exe	27
PID 1516 wrote to memory of 2012	1516	7220f9ec81df613dd5f9e83664e117948477ffb8462e908ed5deb6147b91b522.exe	27
PID 1516 wrote to memory of 2012	1516	7220f9ec81df613dd5f9e83664e117948477ffb8462e908ed5deb6147b91b522.exe	27

C:\Users\Admin\AppData\Local\Temp\7220f9ec81df613dd5f9e83664e117948477ffb8462e908ed5deb6147b91b522.exe
"C:\Users\Admin\AppData\Local\Temp\7220f9ec81df613dd5f9e83664e117948477ffb8462e908ed5deb6147b91b522.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 88
  2⤵
  - Program crash
  PID:2012