f9bd45c2a8e79aa58718335f095feff5ba66564f5581514ae439ddf2f233341d

Analysis

max time kernel
46s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-11-2022 03:48

Target

b4d79d938c59ac9dde8e6694cb592150.exe
Size

638KB
MD5

b4d79d938c59ac9dde8e6694cb592150
SHA1

87f94a89b7f183ce26a81a6ac5094c726046db30
SHA256

f9bd45c2a8e79aa58718335f095feff5ba66564f5581514ae439ddf2f233341d
SHA512

d6e69c50de67bd51a11cc398d6b1cf992d902bf77c083a56f91c4c512269ef6f61a4507acb40d8be090900c3161065d7a9cb0cbbcef7fa2b41d8216d5190d1b4
SSDEEP

6144:atbRgxNUu/WCYGQNzHhsFvkXWBQ0k4SfllfbrkKCZQ0rwVll9oQYGxt3Mn3:aNRgcpCYrNzBUlSzhdbOrsCQYGW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1544	816	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 1544	816	b4d79d938c59ac9dde8e6694cb592150.exe	27
PID 816 wrote to memory of 1544	816	b4d79d938c59ac9dde8e6694cb592150.exe	27
PID 816 wrote to memory of 1544	816	b4d79d938c59ac9dde8e6694cb592150.exe	27
PID 816 wrote to memory of 1544	816	b4d79d938c59ac9dde8e6694cb592150.exe	27

C:\Users\Admin\AppData\Local\Temp\b4d79d938c59ac9dde8e6694cb592150.exe
"C:\Users\Admin\AppData\Local\Temp\b4d79d938c59ac9dde8e6694cb592150.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 660
  2⤵
  - Program crash
  PID:1544

memory/816-54-0x0000000000320000-0x00000000003C6000-memory.dmp

Filesize
664KB

Download
memory/816-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/816-56-0x0000000000600000-0x0000000000618000-memory.dmp

Filesize
96KB

Download
memory/816-57-0x0000000000310000-0x000000000031C000-memory.dmp

Filesize
48KB

Download