0851bd4314a1d9b516950aae8801f31d6398b411c29f6b374e96500ca504ba9a

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 06:12

Target

0851bd4314a1d9b516950aae8801f31d6398b411c29f6b374e96500ca504ba9a.exe
Size

111KB
MD5

0a098dc1b87fc4de8f5c3988e0b9b140
SHA1

93b2b3c48e31fe38ef4a18a481cfd1d0e8a2d497
SHA256

0851bd4314a1d9b516950aae8801f31d6398b411c29f6b374e96500ca504ba9a
SHA512

3f1a6b9256fd23e1787bef81dbbe7d1c582d14c4f4b05e73269a327df821eb6bb24e33d24b9de72bc861bd777a9bf380ab97c2a2ba53a1e58cfc655ad0e14f56
SSDEEP

3072:kiz1XtIIdEK47f1qpkX0Q8dCHs2qH2k54:kih9II+Q+XUdqOF4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1116	1948	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1116	1948	0851bd4314a1d9b516950aae8801f31d6398b411c29f6b374e96500ca504ba9a.exe	28
PID 1948 wrote to memory of 1116	1948	0851bd4314a1d9b516950aae8801f31d6398b411c29f6b374e96500ca504ba9a.exe	28
PID 1948 wrote to memory of 1116	1948	0851bd4314a1d9b516950aae8801f31d6398b411c29f6b374e96500ca504ba9a.exe	28
PID 1948 wrote to memory of 1116	1948	0851bd4314a1d9b516950aae8801f31d6398b411c29f6b374e96500ca504ba9a.exe	28

C:\Users\Admin\AppData\Local\Temp\0851bd4314a1d9b516950aae8801f31d6398b411c29f6b374e96500ca504ba9a.exe
"C:\Users\Admin\AppData\Local\Temp\0851bd4314a1d9b516950aae8801f31d6398b411c29f6b374e96500ca504ba9a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 36
  2⤵
  - Program crash
  PID:1116

memory/1948-55-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download