343a7af26b4e31885dc84a8352b7fbb04d98c1df61038d7f65f56c2ac407955c

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 06:17

Target

343a7af26b4e31885dc84a8352b7fbb04d98c1df61038d7f65f56c2ac407955c.exe
Size

63KB
MD5

319b70b6763550d0bb3fb80ebcd7a60a
SHA1

4f54c301cf524bfd161b48f13532c8442e8a7d2f
SHA256

343a7af26b4e31885dc84a8352b7fbb04d98c1df61038d7f65f56c2ac407955c
SHA512

75ef0fc079cba20346b59aa9df4d38933067b6913137ab6018b91d57194ac96b816a7dc8b16ddcb88ef6747e5ba73350338dae8e0d5ec77c44152b1d4f666b24
SSDEEP

1536:MapCNhTq+hH4T+HYfK6SMz74S1vPUcI4F0WTgRV1adFOsgXpdv:NwNhTqpwYC6SWUn4uWUR8FOscpdv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	1056	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 2028	1056	343a7af26b4e31885dc84a8352b7fbb04d98c1df61038d7f65f56c2ac407955c.exe	26
PID 1056 wrote to memory of 2028	1056	343a7af26b4e31885dc84a8352b7fbb04d98c1df61038d7f65f56c2ac407955c.exe	26
PID 1056 wrote to memory of 2028	1056	343a7af26b4e31885dc84a8352b7fbb04d98c1df61038d7f65f56c2ac407955c.exe	26
PID 1056 wrote to memory of 2028	1056	343a7af26b4e31885dc84a8352b7fbb04d98c1df61038d7f65f56c2ac407955c.exe	26

C:\Users\Admin\AppData\Local\Temp\343a7af26b4e31885dc84a8352b7fbb04d98c1df61038d7f65f56c2ac407955c.exe
"C:\Users\Admin\AppData\Local\Temp\343a7af26b4e31885dc84a8352b7fbb04d98c1df61038d7f65f56c2ac407955c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 36
  2⤵
  - Program crash
  PID:2028

memory/1056-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download