43065ca95cda244f1460334e052b2c1888ea6672693fbc3144ff15ba6299c6de

Analysis

max time kernel
39s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 19:27

Target

43065ca95cda244f1460334e052b2c1888ea6672693fbc3144ff15ba6299c6de.exe
Size

110KB
MD5

0f70676675dcd32d8da8ecba08dbf262
SHA1

5a132c27e6d1664f4933f510dc19b24286d5a5da
SHA256

43065ca95cda244f1460334e052b2c1888ea6672693fbc3144ff15ba6299c6de
SHA512

95161bdc37424825c680c7ab6291acd1742bc3284630280b5ae49802cf5c376955ee284247f07674b083b0f92ce5ea07ece1fd2a75f2f89d0938fe858d651bf2
SSDEEP

3072:llF6UlOTuMa7YktPS1wW+k5SCsu2oh40kv3VucVE9:llXYki5Fsu6vFuD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1448	1708	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1448	1708	43065ca95cda244f1460334e052b2c1888ea6672693fbc3144ff15ba6299c6de.exe	27
PID 1708 wrote to memory of 1448	1708	43065ca95cda244f1460334e052b2c1888ea6672693fbc3144ff15ba6299c6de.exe	27
PID 1708 wrote to memory of 1448	1708	43065ca95cda244f1460334e052b2c1888ea6672693fbc3144ff15ba6299c6de.exe	27
PID 1708 wrote to memory of 1448	1708	43065ca95cda244f1460334e052b2c1888ea6672693fbc3144ff15ba6299c6de.exe	27

C:\Users\Admin\AppData\Local\Temp\43065ca95cda244f1460334e052b2c1888ea6672693fbc3144ff15ba6299c6de.exe
"C:\Users\Admin\AppData\Local\Temp\43065ca95cda244f1460334e052b2c1888ea6672693fbc3144ff15ba6299c6de.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 36
  2⤵
  - Program crash
  PID:1448

memory/1708-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download