975fb96dbf2fe037e4e8f7c91509030fb214775aeb613021abb5207ba31f94bd

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 07:05

Target

975fb96dbf2fe037e4e8f7c91509030fb214775aeb613021abb5207ba31f94bd.exe
Size

96KB
MD5

05a492debbb8c713ddf0bca4f61cb59d
SHA1

6a62cf9ba30fc0d740f15e70fc643cef7f9bb0c8
SHA256

975fb96dbf2fe037e4e8f7c91509030fb214775aeb613021abb5207ba31f94bd
SHA512

d2f815bf74dfb05a0aaa694ef6305e3c8ca524ef0bd4db6c9f3d7120a6ebdbc7a2d358e47430e955d6e88c1beb4224de1ee961e1c3cf07e0a397c138731a8a46
SSDEEP

1536:hOeTaQoIF3tsnoYwZeaapXq8OmNR6ayv3gR07Wt5hDQ2o/Wb6u8GrsqwKfX2VqaC:5aQo03tPdZeVXq8xNR6tgR07WtU/WbfX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1128	2016	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1128	2016	975fb96dbf2fe037e4e8f7c91509030fb214775aeb613021abb5207ba31f94bd.exe	26
PID 2016 wrote to memory of 1128	2016	975fb96dbf2fe037e4e8f7c91509030fb214775aeb613021abb5207ba31f94bd.exe	26
PID 2016 wrote to memory of 1128	2016	975fb96dbf2fe037e4e8f7c91509030fb214775aeb613021abb5207ba31f94bd.exe	26
PID 2016 wrote to memory of 1128	2016	975fb96dbf2fe037e4e8f7c91509030fb214775aeb613021abb5207ba31f94bd.exe	26

C:\Users\Admin\AppData\Local\Temp\975fb96dbf2fe037e4e8f7c91509030fb214775aeb613021abb5207ba31f94bd.exe
"C:\Users\Admin\AppData\Local\Temp\975fb96dbf2fe037e4e8f7c91509030fb214775aeb613021abb5207ba31f94bd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 164
  2⤵
  - Program crash
  PID:1128

memory/2016-54-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download