268a3de609212d5c407d4745a9d5699e75f1396e6c13b67c1970f2d837e73a95

Analysis

max time kernel
31s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 21:46

Target

268a3de609212d5c407d4745a9d5699e75f1396e6c13b67c1970f2d837e73a95.exe
Size

612KB
MD5

08ef5db4476a37c196ff7edc64393c7c
SHA1

91b046ffe773029260a22536d8d2837851cb393b
SHA256

268a3de609212d5c407d4745a9d5699e75f1396e6c13b67c1970f2d837e73a95
SHA512

95af317648c99a2c8920574402a79d8a6530b8c9efcae46d8698a139edacc29774b5606ac9bfb19dcb40e350990f88fbf79a61077ee244d614cb730787556da5
SSDEEP

6144:ZMmY5yrfyHzy8fwRASAywPGvmPrps0q4oMOOyQlTgALXqo1jmUZxL6xQGQgg:ZZ0yrOGtRS9Gvmg4oMOOPZNLXqs76P

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1380	1348	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1380	1348	268a3de609212d5c407d4745a9d5699e75f1396e6c13b67c1970f2d837e73a95.exe	26
PID 1348 wrote to memory of 1380	1348	268a3de609212d5c407d4745a9d5699e75f1396e6c13b67c1970f2d837e73a95.exe	26
PID 1348 wrote to memory of 1380	1348	268a3de609212d5c407d4745a9d5699e75f1396e6c13b67c1970f2d837e73a95.exe	26
PID 1348 wrote to memory of 1380	1348	268a3de609212d5c407d4745a9d5699e75f1396e6c13b67c1970f2d837e73a95.exe	26

C:\Users\Admin\AppData\Local\Temp\268a3de609212d5c407d4745a9d5699e75f1396e6c13b67c1970f2d837e73a95.exe
"C:\Users\Admin\AppData\Local\Temp\268a3de609212d5c407d4745a9d5699e75f1396e6c13b67c1970f2d837e73a95.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 132
  2⤵
  - Program crash
  PID:1380

memory/1348-54-0x00000000750A1000-0x00000000750A3000-memory.dmp

Filesize
8KB

Download
memory/1348-56-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download