f290a4203f885a875dd33886f5b0fbdcce6245b62fd74df2f45f3bbcbc062fcc

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 02:40

Target

f290a4203f885a875dd33886f5b0fbdcce6245b62fd74df2f45f3bbcbc062fcc.exe
Size

107KB
MD5

05695eb00acee20a398b80fb6f12043a
SHA1

6a844b577d63b5c6f2baf4ba075b284165a8e6fc
SHA256

f290a4203f885a875dd33886f5b0fbdcce6245b62fd74df2f45f3bbcbc062fcc
SHA512

08cb188b69fd157eb8dfad36345532d9aceb3d1d39bbcd4a14710b064de4208225d37352fc00b1f35b4deace453b3c713b1e3466e2f66049bd3c41d506bf7e98
SSDEEP

1536:y+FDoKtniY1u7Nn2JFkC2styJjCKICFjC7EWisS+5mlatSfkZzZ:y+FDzK71QkbstyJjCKICpC72s/mlaXzZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1396	1600	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1396	1600	f290a4203f885a875dd33886f5b0fbdcce6245b62fd74df2f45f3bbcbc062fcc.exe	27
PID 1600 wrote to memory of 1396	1600	f290a4203f885a875dd33886f5b0fbdcce6245b62fd74df2f45f3bbcbc062fcc.exe	27
PID 1600 wrote to memory of 1396	1600	f290a4203f885a875dd33886f5b0fbdcce6245b62fd74df2f45f3bbcbc062fcc.exe	27
PID 1600 wrote to memory of 1396	1600	f290a4203f885a875dd33886f5b0fbdcce6245b62fd74df2f45f3bbcbc062fcc.exe	27

C:\Users\Admin\AppData\Local\Temp\f290a4203f885a875dd33886f5b0fbdcce6245b62fd74df2f45f3bbcbc062fcc.exe
"C:\Users\Admin\AppData\Local\Temp\f290a4203f885a875dd33886f5b0fbdcce6245b62fd74df2f45f3bbcbc062fcc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 128
  2⤵
  - Program crash
  PID:1396

memory/1600-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download