47bcb1366967e5be7d0e253175b47ff572d6f8a7a6a07f021d487a0440c013f5

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 02:42

Target

47bcb1366967e5be7d0e253175b47ff572d6f8a7a6a07f021d487a0440c013f5.exe
Size

106KB
MD5

0e71b3a082c7da383228cfde5e73d95f
SHA1

710e3f50c57a131141622f4852f047417115c8d0
SHA256

47bcb1366967e5be7d0e253175b47ff572d6f8a7a6a07f021d487a0440c013f5
SHA512

933e2489aa841c4831cb23578a85ee02ef0f29b486ad146ff2207cfb5632064b51106c13209bae0cdfe54636f0c47d99d68b6d4249a0005a62eac9cd93a699f3
SSDEEP

1536:X+FDoKtniY1u7Nn2JFkC2styJjCKICFjC7EWisS+5mlatSfkZv:X+FDzK71QkbstyJjCKICpC72s/mlaXv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1036	1784	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 1036	1784	47bcb1366967e5be7d0e253175b47ff572d6f8a7a6a07f021d487a0440c013f5.exe	28
PID 1784 wrote to memory of 1036	1784	47bcb1366967e5be7d0e253175b47ff572d6f8a7a6a07f021d487a0440c013f5.exe	28
PID 1784 wrote to memory of 1036	1784	47bcb1366967e5be7d0e253175b47ff572d6f8a7a6a07f021d487a0440c013f5.exe	28
PID 1784 wrote to memory of 1036	1784	47bcb1366967e5be7d0e253175b47ff572d6f8a7a6a07f021d487a0440c013f5.exe	28

C:\Users\Admin\AppData\Local\Temp\47bcb1366967e5be7d0e253175b47ff572d6f8a7a6a07f021d487a0440c013f5.exe
"C:\Users\Admin\AppData\Local\Temp\47bcb1366967e5be7d0e253175b47ff572d6f8a7a6a07f021d487a0440c013f5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 128
  2⤵
  - Program crash
  PID:1036

memory/1784-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download