ba652588ae5ffc8ddd84449085feb89019c4bff80a961ab051324568eff41eb8

Analysis

max time kernel
48s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 05:21

Target

ba652588ae5ffc8ddd84449085feb89019c4bff80a961ab051324568eff41eb8.exe
Size

254KB
MD5

103f06462e682c8e6447f0024edbb4b1
SHA1

8099c07aba3ce07e1d745e615d7ad633980e370d
SHA256

ba652588ae5ffc8ddd84449085feb89019c4bff80a961ab051324568eff41eb8
SHA512

686a408e5da02c192373b93a695c30a16e662200904df1bdb1f49556a6bc8aeb2bf855312a66372f4dc99c339a176d56cea11c23addc55b6fe003b7b6175213a
SSDEEP

6144:87eztFkaJZ+e/c3xVgG+ZY0HqkiPbueAu1bIfEv5AwC:5tnH+e/cfgGsY0HqkiPW+AERFC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1612	1544	WerFault.exe	25

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1612	1544	ba652588ae5ffc8ddd84449085feb89019c4bff80a961ab051324568eff41eb8.exe	26
PID 1544 wrote to memory of 1612	1544	ba652588ae5ffc8ddd84449085feb89019c4bff80a961ab051324568eff41eb8.exe	26
PID 1544 wrote to memory of 1612	1544	ba652588ae5ffc8ddd84449085feb89019c4bff80a961ab051324568eff41eb8.exe	26
PID 1544 wrote to memory of 1612	1544	ba652588ae5ffc8ddd84449085feb89019c4bff80a961ab051324568eff41eb8.exe	26
PID 1544 wrote to memory of 1612	1544	ba652588ae5ffc8ddd84449085feb89019c4bff80a961ab051324568eff41eb8.exe	26
PID 1544 wrote to memory of 1612	1544	ba652588ae5ffc8ddd84449085feb89019c4bff80a961ab051324568eff41eb8.exe	26
PID 1544 wrote to memory of 1612	1544	ba652588ae5ffc8ddd84449085feb89019c4bff80a961ab051324568eff41eb8.exe	26

C:\Users\Admin\AppData\Local\Temp\ba652588ae5ffc8ddd84449085feb89019c4bff80a961ab051324568eff41eb8.exe
"C:\Users\Admin\AppData\Local\Temp\ba652588ae5ffc8ddd84449085feb89019c4bff80a961ab051324568eff41eb8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 272
  2⤵
  - Program crash
  PID:1612

memory/1544-54-0x0000000075681000-0x0000000075683000-memory.dmp

Filesize
8KB

Download
memory/1544-56-0x0000000001000000-0x00000000010879B8-memory.dmp

Filesize
542KB

Download
memory/1544-57-0x0000000000170000-0x00000000001F8000-memory.dmp

Filesize
544KB

Download