84e912da769e0cffcb7eece43b665cf6fd0775d72133d4261bdcb5192a352c76

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 18:54

Target

84e912da769e0cffcb7eece43b665cf6fd0775d72133d4261bdcb5192a352c76.exe
Size

152KB
MD5

01faa7ad620f8461904c07374ab01ab0
SHA1

622e8ba8267633ad4e777b439e34703168f46ab6
SHA256

84e912da769e0cffcb7eece43b665cf6fd0775d72133d4261bdcb5192a352c76
SHA512

7858e3f367aafb92ed9c39757d64a9633342386edf560a2692c351cc0fff78e30679907d011b33a94c680311d78ec0b8f912e1513589a36e586451818b424b37
SSDEEP

3072:Cryg2p7Zqe8MoN7kfJBoz6vljqlvcp+BNwShOjmrNlDKbEc3:t8Mi7IezgjNgC3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
988	1768	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 988	1768	84e912da769e0cffcb7eece43b665cf6fd0775d72133d4261bdcb5192a352c76.exe	27
PID 1768 wrote to memory of 988	1768	84e912da769e0cffcb7eece43b665cf6fd0775d72133d4261bdcb5192a352c76.exe	27
PID 1768 wrote to memory of 988	1768	84e912da769e0cffcb7eece43b665cf6fd0775d72133d4261bdcb5192a352c76.exe	27
PID 1768 wrote to memory of 988	1768	84e912da769e0cffcb7eece43b665cf6fd0775d72133d4261bdcb5192a352c76.exe	27

C:\Users\Admin\AppData\Local\Temp\84e912da769e0cffcb7eece43b665cf6fd0775d72133d4261bdcb5192a352c76.exe
"C:\Users\Admin\AppData\Local\Temp\84e912da769e0cffcb7eece43b665cf6fd0775d72133d4261bdcb5192a352c76.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 188
  2⤵
  - Program crash
  PID:988

memory/1768-54-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/1768-56-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download