abd4ca79d8ca983d426777dd8f2ff0f6953b8abcdb165a961a910767e645843b

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 06:04

Target

abd4ca79d8ca983d426777dd8f2ff0f6953b8abcdb165a961a910767e645843b.exe
Size

7KB
MD5

5ff3cdf67124d8fa621e9244d7c6565e
SHA1

b715dfdb341b09ce97e773d62e9b371cd2c8fc02
SHA256

abd4ca79d8ca983d426777dd8f2ff0f6953b8abcdb165a961a910767e645843b
SHA512

2e52528bb8e6edfa017deede6e19ce8847abcb023a4bd4f96a9843476ec58cd278750b309c4a86d48527ea6bc9dfddeb7f5adec7ba2fd9053f697528c08e372d
SSDEEP

96:bFd+xnro+TYgQT+81Dd65VfqAvgk/OQXzNt:D+huxg5VDKQB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1288	620	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 1288	620	abd4ca79d8ca983d426777dd8f2ff0f6953b8abcdb165a961a910767e645843b.exe	27
PID 620 wrote to memory of 1288	620	abd4ca79d8ca983d426777dd8f2ff0f6953b8abcdb165a961a910767e645843b.exe	27
PID 620 wrote to memory of 1288	620	abd4ca79d8ca983d426777dd8f2ff0f6953b8abcdb165a961a910767e645843b.exe	27
PID 620 wrote to memory of 1288	620	abd4ca79d8ca983d426777dd8f2ff0f6953b8abcdb165a961a910767e645843b.exe	27

C:\Users\Admin\AppData\Local\Temp\abd4ca79d8ca983d426777dd8f2ff0f6953b8abcdb165a961a910767e645843b.exe
"C:\Users\Admin\AppData\Local\Temp\abd4ca79d8ca983d426777dd8f2ff0f6953b8abcdb165a961a910767e645843b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 540
  2⤵
  - Program crash
  PID:1288

memory/620-54-0x0000000001200000-0x0000000001208000-memory.dmp

Filesize
32KB

Download