f9bd45c2a8e79aa58718335f095feff5ba66564f5581514ae439ddf2f233341d

Analysis

max time kernel
52s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-11-2022 03:47

Target

b4d79d938c59ac9dde8e6694cb592150.exe
Size

638KB
MD5

b4d79d938c59ac9dde8e6694cb592150
SHA1

87f94a89b7f183ce26a81a6ac5094c726046db30
SHA256

f9bd45c2a8e79aa58718335f095feff5ba66564f5581514ae439ddf2f233341d
SHA512

d6e69c50de67bd51a11cc398d6b1cf992d902bf77c083a56f91c4c512269ef6f61a4507acb40d8be090900c3161065d7a9cb0cbbcef7fa2b41d8216d5190d1b4
SSDEEP

6144:atbRgxNUu/WCYGQNzHhsFvkXWBQ0k4SfllfbrkKCZQ0rwVll9oQYGxt3Mn3:aNRgcpCYrNzBUlSzhdbOrsCQYGW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1700	1968	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1700	1968	b4d79d938c59ac9dde8e6694cb592150.exe	26
PID 1968 wrote to memory of 1700	1968	b4d79d938c59ac9dde8e6694cb592150.exe	26
PID 1968 wrote to memory of 1700	1968	b4d79d938c59ac9dde8e6694cb592150.exe	26
PID 1968 wrote to memory of 1700	1968	b4d79d938c59ac9dde8e6694cb592150.exe	26

C:\Users\Admin\AppData\Local\Temp\b4d79d938c59ac9dde8e6694cb592150.exe
"C:\Users\Admin\AppData\Local\Temp\b4d79d938c59ac9dde8e6694cb592150.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 664
  2⤵
  - Program crash
  PID:1700

memory/1968-54-0x0000000000CF0000-0x0000000000D96000-memory.dmp

Filesize
664KB

Download
memory/1968-55-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download
memory/1968-56-0x0000000000230000-0x0000000000248000-memory.dmp

Filesize
96KB

Download
memory/1968-57-0x0000000000200000-0x000000000020C000-memory.dmp

Filesize
48KB

Download