7da9849a6ba8628dca191501aad3534c501dd97d92a8e765c73503e25ad2083e

Analysis

max time kernel
33s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 06:03

Target

7da9849a6ba8628dca191501aad3534c501dd97d92a8e765c73503e25ad2083e.exe
Size

320KB
MD5

2872c2c212a1d121c3290fd81c69c780
SHA1

7bfee974b5a392c4841a0d94a11feaac5fb0302e
SHA256

7da9849a6ba8628dca191501aad3534c501dd97d92a8e765c73503e25ad2083e
SHA512

7b4d42253890f56d337d13306ce355e54db49e5a0432c682e7120919b3a73c0be07a9a80372929dafb6c6040a881913acc878f469beafad974bbcd756275b3b2
SSDEEP

6144:hUIjtjX8yGoH2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:hlXl2EB0NxDIBuOFe7/uT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1956	1404	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 1956	1404	7da9849a6ba8628dca191501aad3534c501dd97d92a8e765c73503e25ad2083e.exe	28
PID 1404 wrote to memory of 1956	1404	7da9849a6ba8628dca191501aad3534c501dd97d92a8e765c73503e25ad2083e.exe	28
PID 1404 wrote to memory of 1956	1404	7da9849a6ba8628dca191501aad3534c501dd97d92a8e765c73503e25ad2083e.exe	28
PID 1404 wrote to memory of 1956	1404	7da9849a6ba8628dca191501aad3534c501dd97d92a8e765c73503e25ad2083e.exe	28

C:\Users\Admin\AppData\Local\Temp\7da9849a6ba8628dca191501aad3534c501dd97d92a8e765c73503e25ad2083e.exe
"C:\Users\Admin\AppData\Local\Temp\7da9849a6ba8628dca191501aad3534c501dd97d92a8e765c73503e25ad2083e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 36
  2⤵
  - Program crash
  PID:1956

memory/1404-55-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download