3397fb865061b8984757f23b03d1cd5902fc8bff3f9eed1ef4700aaaa158edca

Analysis

max time kernel
25s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 18:00

Target

3397fb865061b8984757f23b03d1cd5902fc8bff3f9eed1ef4700aaaa158edca.exe
Size

141KB
MD5

48d421153a4f3c8a5ac97b7ff5699cec
SHA1

b4301fd69642b5541a85317f89f9890e3e1c2796
SHA256

3397fb865061b8984757f23b03d1cd5902fc8bff3f9eed1ef4700aaaa158edca
SHA512

c79b1ad0d49bc07c9f9a00b5f4f2b4bcdbb11508df170c36518f61a86c063e6592af2c3aab3599b96c0fd53c4d8c40422f8b7abe009c7aa152f3eebbc0d08033
SSDEEP

3072:m5tmM+mZqQH3Us4QL1nMqqDL2/OPvdlN:m5t3dj4QL1MqqDL6svdlN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1488	1448	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1488	1448	3397fb865061b8984757f23b03d1cd5902fc8bff3f9eed1ef4700aaaa158edca.exe	28
PID 1448 wrote to memory of 1488	1448	3397fb865061b8984757f23b03d1cd5902fc8bff3f9eed1ef4700aaaa158edca.exe	28
PID 1448 wrote to memory of 1488	1448	3397fb865061b8984757f23b03d1cd5902fc8bff3f9eed1ef4700aaaa158edca.exe	28
PID 1448 wrote to memory of 1488	1448	3397fb865061b8984757f23b03d1cd5902fc8bff3f9eed1ef4700aaaa158edca.exe	28

C:\Users\Admin\AppData\Local\Temp\3397fb865061b8984757f23b03d1cd5902fc8bff3f9eed1ef4700aaaa158edca.exe
"C:\Users\Admin\AppData\Local\Temp\3397fb865061b8984757f23b03d1cd5902fc8bff3f9eed1ef4700aaaa158edca.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 36
  2⤵
  - Program crash
  PID:1488