3a5991c2089525211dc6340452beeee15a04f78f97ba336ebc1639ab31300a37

Analysis

max time kernel
31s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 19:18

Target

3a5991c2089525211dc6340452beeee15a04f78f97ba336ebc1639ab31300a37.exe
Size

387KB
MD5

062787a069b7c0f2fa703b7a138b1c44
SHA1

c17872a0e03bcc671c5a6bebe22744bfc18cd1f8
SHA256

3a5991c2089525211dc6340452beeee15a04f78f97ba336ebc1639ab31300a37
SHA512

d33b044d986654040c499ff93363021fafc4857151e33642570296b983dc82ca0096a9982d2960f90c27fe6a6702d92f6c0df547085029192c75c07439a42bf7
SSDEEP

12288:UcDLA3hKpD7Jm4oA+Ztdg+Ob/aZdzbydwR9p:K3QM11wKqup

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1620	364	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1620	364	3a5991c2089525211dc6340452beeee15a04f78f97ba336ebc1639ab31300a37.exe	26
PID 364 wrote to memory of 1620	364	3a5991c2089525211dc6340452beeee15a04f78f97ba336ebc1639ab31300a37.exe	26
PID 364 wrote to memory of 1620	364	3a5991c2089525211dc6340452beeee15a04f78f97ba336ebc1639ab31300a37.exe	26
PID 364 wrote to memory of 1620	364	3a5991c2089525211dc6340452beeee15a04f78f97ba336ebc1639ab31300a37.exe	26

C:\Users\Admin\AppData\Local\Temp\3a5991c2089525211dc6340452beeee15a04f78f97ba336ebc1639ab31300a37.exe
"C:\Users\Admin\AppData\Local\Temp\3a5991c2089525211dc6340452beeee15a04f78f97ba336ebc1639ab31300a37.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 364 -s 96
  2⤵
  - Program crash
  PID:1620

memory/364-54-0x0000000000570000-0x00000000005DC000-memory.dmp

Filesize
432KB

Download