64c6d89ef5ce90db2ae6ad52998252da70de429628a701467c54638117def812

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 19:01

Target

64c6d89ef5ce90db2ae6ad52998252da70de429628a701467c54638117def812.exe
Size

164KB
MD5

0c32c2dec75fc8c5d56c83c31b090a81
SHA1

0ccf53af930920ea4c888c814af97fbfb30efc03
SHA256

64c6d89ef5ce90db2ae6ad52998252da70de429628a701467c54638117def812
SHA512

59ecb0c66674593ace69f54c6009edfbd70f741e60be7aa0f540f0d8fddfba5ea77a2b56d00cf22748c6117008013213bc35a1b2fb16bcf9617a63d533869f33
SSDEEP

3072:DNQKPWDy3I0hJltZrpRRyBvAcDE8dJJBQWryGJqJ75ubyoWnDDr:DNSDy3ISthpk9E8zvtyGm1ubYvr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1352	1392	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 1352	1392	64c6d89ef5ce90db2ae6ad52998252da70de429628a701467c54638117def812.exe	27
PID 1392 wrote to memory of 1352	1392	64c6d89ef5ce90db2ae6ad52998252da70de429628a701467c54638117def812.exe	27
PID 1392 wrote to memory of 1352	1392	64c6d89ef5ce90db2ae6ad52998252da70de429628a701467c54638117def812.exe	27
PID 1392 wrote to memory of 1352	1392	64c6d89ef5ce90db2ae6ad52998252da70de429628a701467c54638117def812.exe	27

C:\Users\Admin\AppData\Local\Temp\64c6d89ef5ce90db2ae6ad52998252da70de429628a701467c54638117def812.exe
"C:\Users\Admin\AppData\Local\Temp\64c6d89ef5ce90db2ae6ad52998252da70de429628a701467c54638117def812.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 160
  2⤵
  - Program crash
  PID:1352

memory/1352-55-0x0000000000000000-mapping.dmp

Download
memory/1392-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1392-56-0x0000000001000000-0x0000000001026000-memory.dmp

Filesize
152KB

Download