3749521d25b8222f5750ac65d7192df1bcfb0e199e18759f05244c9d062cc8e3

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/11/2022, 01:21

Target

3749521d25b8222f5750ac65d7192df1bcfb0e199e18759f05244c9d062cc8e3.exe
Size

174KB
MD5

dc313028d16fa3edf142d9d6e67acfe1
SHA1

21cba9213bbd25a3f228f5b0c48de0e68929c8a9
SHA256

3749521d25b8222f5750ac65d7192df1bcfb0e199e18759f05244c9d062cc8e3
SHA512

b726902ec0e4498508bea44987291f9d781596539b861a8bc9a2aade84f7a3801e5a91ebb116fd7f7ac950abef609e6f372cd2c51e06321467ac93b244fa2d06
SSDEEP

3072:KZ/LhS0rKgHq+rFLIwgoovufDUbZMYIWJkRI5Se:+/LhS0rKE/FLITo9mpIWWR+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1748	1492	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1748	1492	3749521d25b8222f5750ac65d7192df1bcfb0e199e18759f05244c9d062cc8e3.exe	27
PID 1492 wrote to memory of 1748	1492	3749521d25b8222f5750ac65d7192df1bcfb0e199e18759f05244c9d062cc8e3.exe	27
PID 1492 wrote to memory of 1748	1492	3749521d25b8222f5750ac65d7192df1bcfb0e199e18759f05244c9d062cc8e3.exe	27
PID 1492 wrote to memory of 1748	1492	3749521d25b8222f5750ac65d7192df1bcfb0e199e18759f05244c9d062cc8e3.exe	27

C:\Users\Admin\AppData\Local\Temp\3749521d25b8222f5750ac65d7192df1bcfb0e199e18759f05244c9d062cc8e3.exe
"C:\Users\Admin\AppData\Local\Temp\3749521d25b8222f5750ac65d7192df1bcfb0e199e18759f05244c9d062cc8e3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 172
  2⤵
  - Program crash
  PID:1748

memory/1492-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download